Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Do they know something we don't about SHA1?

It's not usual for Microsoft to be a first mover in cases like these, as far as I can remember?

Also, is there a source on *.microsoft.com for this announcement?



http://technet.microsoft.com/en-us/security/advisory/2880823

http://blogs.technet.com/b/srd/archive/2013/11/12/security-a...


Probably not. And, when it comes to crypto compatibility, there really is no such thing as "normal". It's all still early days.


Just noticed all four certs in the chain on https://www.microsoft.com use SHA1. The root cert, "Baltimore CyberTrust Root", expires in 2025. Will root CAs also have to be replaced by 2016?

The relative urgency around this cutoff comes off as panick-y to me. They never seemed to bother updating roots or add SNI support for older, still supported OSes like WinXP.


Windows XP is officially dead in 144 days, so they're likely unconcerned on that front.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: