Hackers obtain counterfeit TLS certificates for Google and other large services
Compromise of 3 domain registries allows hackers to walk off with unauthorized certs.
https://arstechnica.com/security/2026/10/hackers-obtain-counterfeit-tls-certificates-for-google-and-other-large-services/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social
@arstechnica This is why we need DANE to be widely adopted and companies to run their own certificate authorities. The big CAs are too lax to be secure, and a single company is less of a target and can react to a compromise faster.
@arstechnica how is the CA the "weak link" here? AFAIK all of the ACME challenge types assume the owner of a domain is the only one who can modify their own DNS records.
@arstechnica The real issue is if you are a large company and there are so many TLDs it is your responsibility to make sure you own all of them. No excuses.