5 ms·
>I suspect we'll ultimately wind up with mainstream device manufacturers maintaining some kind of per-device master key that they turn over when ordered. It wi
by Sir_Substance 11y ago
>I suspect we'll ultimately wind up with mainstream device manufacturers maintaining some kind of per-device master key that they turn over when ordered.
It will be impossible to secure that database. Any number and size of bribes would be worth spreading around to gain a dump of it. Once I have a dump, you're up shit creek because you're faced with changing every key of every device you've ever sold to resecure them. However, any key changing mechanism you create is an exploitation vector criminals can use to randomly scramble their "master key" and not report the new one to you, and again, any certs you use to secure this process will become v cost effective to bribe for. So we're left with a situation where one breach screws everyone and it hurts legitimate users way more than the criminals it is targeted at.
Back doors are back doors man. Anyone can use the door handle, once it exists.
- Scea91 11y agoThese kind of master keys already exists so it is not something hypothetical. I am talking about the private keys of trusted root certification authorities. If it would be as easy to get them as you say nobody would probably use TLS since it would be useless.
- mirimir 11y agoWell, TLS with "trusted" CAs is useless, for extreme threat models.
- csallen 11y agoCare to elaborate?
- mirimir 11y agoYou're vulnerable to MitM if adversaries have issued fraudulent certificates for sites that you use. And we know that this has happened, more than once.
- facetube 11y agoAnd that'll only get worse if the FBI succeeds in compelling a US technology company to sign something they don't trust.
- rqebmm 11y agoI think the point is that it's easier to spoof a trusted cert than to crack the encryption
- syncsynchalt 11y agohttp://thenextweb.com/insider/2015/04/02/google-to-drop-chinas-cnnic-root-certificate-authority-after-trust-breach/#gref http://thenextweb.com/insider/2015/04/02/google-to-drop-chin... it's not tinfoil to note that there are CAs under the control of authoritarian governments.