The case of the fraudulent SSL certificates

It is untrue and inflammatory to say that "browsers are generally not checking the revocation status of certificates". There are no browsers which don't check. The issue here is the possibility that a user might not be able to reach the URLs at which revocation information is found.

"In addition, many browsers do not keep track of the certificates that they have received and alert users when they change." This is true, but the entire point of the certificate model is that this is not necessary. And if it were done, users would be bombarded with cert change errors, because certs change regularly. They would just learn to ignore them.

The two test certificates for which Jacob could find no match in the CRLs were issued to Google and Mozilla to test their blacklisting code.

Gerv