Hacker News Reader

Comment by johnp_ | Hacker News Reader

I remember that there was some talk about double voting (WoSign and StartCom not being separate entities, but voting with two votes) in the mailing list. Is there a reason as to why this event hasn't been included in the document?

edit: https://groups.google.com/forum/#!topic/mozilla.dev.security...

> "In no case were these the deciding votes."

View on HN

The issue you're describing is a concern for the CA/B Forum, not really all that relevant for Mozilla/mozilla.dev.security.policy. That being said, the CA/B Forum seems to be discussing the issue[1].

[1]: https://twitter.com/sleevi_/status/780454860676149248

Thank you, though the Qihoo relationship is not what I was referring to.

I actually meant executing two votes in the CA/B Forum. As the connection between WoSign and StartCom was only incidentally found while investigating the other issues, I am questioning if there may be more dark sheep in the herd of CAs... we may just haven't looked hard enough. Do the Audit Requirements include checking for such relationships?

That's in all likelihood the same issue - Qihoo de facto owning two CAs who currently cast two separate votes in the CA/B Forum. Not sure if it would be a concern otherwise (i.e. if Qihoo were to own just one CA and not disclose that fact, I don't think that's relevant for the CA/B Forum, leaving aside the problem that they're also a member as a browser vendor ...)

I think the voting rules are part of the bylaws (and not the Baseline Requirements), so I'm not certain if that's something that's looked into during the audits.

It's in the wiki

https://wiki.mozilla.org/CA:WoSign_Issues

Could you please refer to the actual Issue? I can neither find anything related to the CA/B-Forum voting fraud nor to the yet unresolved Qihoo relationship.

Issue R? https://wiki.mozilla.org/CA:WoSign_Issues#Issue_R:_Purchase_...

Which links to

https://groups.google.com/forum/#!topic/mozilla.dev.security...

Reply on news.ycombinator.com