A long-known but little-discussed vulnerability in the modern
Internet's design was highlighted yesterday by a report that
hackers traced to Iran spoofed the encryption procedures used to
secure connections to Google, Yahoo, Microsoft, and other major
Web sites. This design, pioneered by Netscape in the early and
mid-1990s, allows the creation of encrypted channels to Web
sites, an important security feature typically identified by a
closed lock icon in a browser. The system relies on third
parties to issue so-called certificates that prove that a Web
site is legitimate when making an "https://" connection. The
problem, however, is that the list of certificate issuers has
ballooned over the years to approximately 650 organizations,
which may not always follow the strictest security procedures.
And each one has a copy of the Web's master keys. "There is this
problem that exists today where there are a very large number of
certificate authorities that are trusted by everyone and
everything," says Peter Eckersle