Recently, there has been a bit of a commotion regarding hackers gaining access to valid SSL and code signing certificates. First there was the stuxnet worm, that was signed with actual certificates stolen from Realtek and JMicron. Then there was comodo-gate. The most recent, and most serious incident happened at dutch company diginotar, and resulted in an (as of yet) unknown number of certificates being issued for unknown sites to unknown parties.
As reporters start to catch on to the magnitude of the diginotar case, and begin to understand the trust implications of a compromised root Certificate Authority, the conversation takes a turn toward gloom and despair. In this post I will offer an alternative reading that strongly suggest that hackers attacking certificates and certificate authorities is actually a huge step forward for security and privacy on the internet.
