4 ms·

I'm not going to disagree with you on the CA system (I'd have to understand it more), but aside from being a product of CAs, what is the issue with EV? EV's bi

I'm not going to disagree with you on the CA system (I'd have to understand it more), but aside from being a product of CAs, what is the issue with EV? EV's biggest problem is DV certificate: it's hard to communicate the nuance between "controls Amazon.com" and "controls Amazon". EV's were a positive step forward, especially with the introduction of the CA/B Forum, as after Let's Encrypt DVs only value is as an encryption mechanism (i.e. not as security, see phishing). Those "human factors" are unavoidable - identity is a "human factor". The integrity of EV is down to the integrity of the CA who are regulated (now) by a strict set of guidelines. So the set of CAs who can administer EVs are a much smaller subset of CAs who can give out DVs.

atmosx 11y ago
“This [attack] was extremely sophisticated and critically executed… It was a very well orchestrated, very clinical attack, and the attacker knew exactly what they needed to do and how fast they had to operate. All the IP addresses were from Iran. All the above leads us to one conclusion only: that this was likely to be a state-driven attack” - Melih Abdulhayoglu, Comodo Founder. Comodo is the CA that issued the biggest percentage of certificates worldwide, they even won an award that year or the year after at RSA conference! If you take a closer look though, as Moxie did[1] - we ’re all grateful - you find out that it takes a douchebag with questionable skillset to bring down the entire infrastructure down to it’s knees. It's hilarious and tragic at the same time. [1] https://www.youtube.com/watch?v=pDmj_xe7EIQ https://www.youtube.com/watch?v=pDmj_xe7EIQ
- thetmkay 11y ago
  Thanks for the link! I will question the relevance of the first half of the talk (about CAs and SSL) in 2015, with TLS and the CA/B Forum. But his main thesis about trust agility is quite spot on. I'd never considered it before, and am going to look into Convergence and TACK. He raises a fantastic question - the duration of trust is a real concern.

atmosx 11y ago

“This [attack] was extremely sophisticated and critically executed… It was a very well orchestrated, very clinical attack, and the attacker knew exactly what they needed to do and how fast they had to operate. All the IP addresses were from Iran. All the above leads us to one conclusion only: that this was likely to be a state-driven attack” - Melih Abdulhayoglu, Comodo Founder. Comodo is the CA that issued the biggest percentage of certificates worldwide, they even won an award that year or the year after at RSA conference! If you take a closer look though, as Moxie did[1] - we ’re all grateful - you find out that it takes a douchebag with questionable skillset to bring down the entire infrastructure down to it’s knees. It's hilarious and tragic at the same time. [1] https://www.youtube.com/watch?v=pDmj_xe7EIQ https://www.youtube.com/watch?v=pDmj_xe7EIQ

thetmkay 11y ago
Thanks for the link! I will question the relevance of the first half of the talk (about CAs and SSL) in 2015, with TLS and the CA/B Forum. But his main thesis about trust agility is quite spot on. I'd never considered it before, and am going to look into Convergence and TACK. He raises a fantastic question - the duration of trust is a real concern.