<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<meta charset="utf-8">
<p style="color: rgb(0, 0, 0); font-size: 10px; font-style: normal;
font-variant: normal; font-weight: normal; letter-spacing: normal;
line-height: normal; orphans: 2; text-align: start; text-indent:
0px; text-transform: none; white-space: normal; widows: 2;
word-spacing: 0px;"><big><big><font face="Gill Sans">Following up
on the conversation last night about door security that
turned to be about SSL and Certificate Authorities, I had
mentioned EFF's SSL Observatory Project (<a class="moz-txt-link-freetext" href="https://www.eff.org/observatory">https://www.eff.org/observatory</a>).
A blurb from the project description is below. If you want
to join the mailing list discussion of the project, that's
at <a class="moz-txt-link-freetext" href="https://mail1.eff.org/mailman/listinfo/observatory">https://mail1.eff.org/mailman/listinfo/observatory</a>.</font></big></big></p>
<p style="color: rgb(0, 0, 0); font-size: 10px; font-style: normal;
font-variant: normal; font-weight: normal; letter-spacing: normal;
line-height: normal; orphans: 2; text-align: start; text-indent:
0px; text-transform: none; white-space: normal; widows: 2;
word-spacing: 0px;"><big><big><font face="Gill Sans"><br>
</font></big></big></p>
<blockquote>
<p style="color: rgb(0, 0, 0); font-size: 10px; font-style:
normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: normal; orphans: 2;
text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;"><big><big><big><big><font
face="Gill Sans"><span style="font-size: 14px;
line-height: 21px;">The EFF SSL Observatory is a
project to investigate the certificates used to
secure all of the sites encrypted with HTTPS on the
Web. We have downloaded datasets of all of the
publicly-visible SSL certificates on the IPv4
Internet, in order to search for vulnerabilities,
document the practices of Certificate Authorities,
and aid researchers interested the web's encryption
infrastructure.</span></font></big></big></big></big></p>
<p style="color: rgb(0, 0, 0); font-size: 10px; font-style:
normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: normal; orphans: 2;
text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;"><font
face="Gill Sans">...</font></p>
<p style="margin: 0.5em 0px 1.3em; padding: 0px; border: 0px none;
font-style: inherit; font-variant: inherit; font-weight:
inherit; font-size: inherit; font-size-adjust: inherit;
font-stretch: inherit; -moz-font-feature-settings: inherit;
-moz-font-language-override: inherit; line-height: 21px;"><font
face="Gill Sans">We are particularly concerned about the role
and practices of Certificate Authorities (CAs), which are the
organizations that can sign cryptographic certificates trusted
by browsers. These certificates can contain statements like,
"this public key belongs to EFF.org", "this public key belongs
to yahoo.com, paypal.com and mozilla.com", or "this public key
should be trusted to also act as a CA, signing certificates
for other domains".</font></p>
<p style="margin: 0.5em 0px 1.3em; padding: 0px; border: 0px none;
font-style: inherit; font-variant: inherit; font-weight:
inherit; font-size: inherit; font-size-adjust: inherit;
font-stretch: inherit; -moz-font-feature-settings: inherit;
-moz-font-language-override: inherit; line-height: 21px;"><font
face="Gill Sans">Browsers trust a very large number of these
CAs, and unfortunately, the security of HTTPS is only as
strong as the practices of the least trustworthy/competent CA.
Before publishing this data, we attempted to notify
administrators of all sites observed vulnerable to <a
href="http://wiki.debian.org/SSLkeys" style="margin: 0px;
padding: 0px; border: 0px none; font-style: inherit;
font-variant: inherit; font-weight: inherit; font-size:
inherit; line-height: inherit; font-size-adjust: inherit;
font-stretch: inherit; -moz-font-feature-settings: inherit;
-moz-font-language-override: inherit; color: rgb(204, 0, 0);
text-decoration: none;">the Debian weak key bug</a>; please
let us know if your analysis reveals other classes of
vulnerabilities so that we can notify affected parties.</font></p>
</blockquote>
<p><font face="Gill Sans"><br>
</font></p>
</body>
</html>