http://ping.fm/LlyQK Comodo-gate hacker brags about forged certificate exploit An Iranian hacker has stepped forward to claim responsibility for the SSL certificate hack against Comodo, providing an insight into how the high-profile hack might have been pulled off. The lock-picker – who claimed he had "1,000 times" the experience of any hacker or programmer – asserted that after compromising Comodo's partner in Italy (GlobalTrust.it and InstantSSL.it) he was able to generate bogus SSL certificates for Skype, Yahoo, Windows Live, mail.google.com and addons.mozilla.org. These forged certificates created the means for others to pose as the targeted websites in man-in-the-middle or phishing attacks. The approach also cleared the way towards preventing users from installing censorship-circumvention Firefox extensions, at least in theory. A total of nine certificates for seven domains were issued during the breach, which occurred on the evening of 15 March. The incident only became public a week later, after browser makers had issued an update: http://ping.fm/1y6Hv , and long after the offending digital certificates had been revoked. The incident sparked a debate about about how digital certificates are issued and revoked. ---- 9 fraudulent digital certificates affect the Google, Skype, Yahoo & Microsoft http://ping.fm/4cEOx