Here are the immediate security issues with CACert:
1. Their HTTPS cert is as good as a self-signed cert; it's invalid and insecure.
2. 2FA is not enabled. This is a huge risk, given the legal ramifications of issuing bad certificates.
3. CACert still signs PGP keys with SHA-1, despite published attacks on this very specific usecase.
Friends don't let friends use CACert.
Follow
bonifartius 𒂼𒄄
@atoponce i'm still pissed at big tech for blocking cacert for ages from being included in browsers. along comes letsencrypt and suddenly it's no problem?
nonwithstanding, cacert has it's problems, but it's a imho better approach than yet another centralized ca, no matter how much automated it is.
