Month: March 2018

Enlarge (credit: unrequited life)

A major dust-up on an Internet discussion forum is touching off troubling questions about the security of some browser-trusted HTTPS certificates when it revealed the CEO of a certificate reseller emailed a partner the sensitive private keys for 23,000 TLS certificates.

The email was sent on Tuesday by the CEO of Trustico, a UK-based reseller of TLS certificates issued by the browser-trusted certificate authorities Comodo and, until recently, Symantec. It was sent to Jeremy Rowley, an executive vice president at DigiCert, a certificate authority that acquired Symantec's certificate issuance business after Symantec was caught flouting binding industry rules, prompting Google to distrust Symantec certificates in its Chrome browser. In communications earlier this month, Trustico notified DigiCert that 50,000 Symantec-issued certificates Trustico had resold should be mass revoked because of security concerns.

Shockingly cavalier

When Rowley asked for proof the certificates were compromised, the Trustico CEO emailed the private keys of 23,000 certificates, according to an account posted to a Mozilla security policy forum. The report produced a collective gasp among many security practitioners who said it demonstrated a shockingly cavalier treatment of the digital certificates that form one of the most basic foundations of website security.

Enlarge (credit: Robbie Shade / Flickr)

A Google engineer says she was a frequent target of regular sexual harassment during her seven years at the company. In a lawsuit filed earlier this month, Loretta Lee (no relation) accused the Mountain View company of having a "bro-culture" that was hostile to women—and of doing too little to address the problem.

The lawsuit is the latest headache from a company that has faced complaints from both sides of the culture war. Last year, Google fired engineer James Damore after he wrote a controversial memo arguing that the under-representation of women at the company might be due to women's lack of interest in computer program. He responded by suing Google for allegedly discriminating against men.

But others have filed lawsuits making the opposite charge: that Google's culture is too hostile toward women—and to men who spoken out against that culture. Three women sued Google in September, charging that Google had systematically channeled female engineers into less lucrative career paths. A transgender man sued Google earlier this month, contending that his criticism of the Damore memo in internal company discussions had contributed to his dismissal.