4 ms·

SWIFT is the only single entity trusted by all banks in the world. I think they would be a perfect fit for a CA to issue online banking certificates, since ther

SWIFT is the only single entity trusted by all banks in the world. I think they would be a perfect fit for a CA to issue online banking certificates, since there is no way to get around trusting SWIFT as a bank, so they might as well trust them for their certificates as well, instead of trusting Symantec or any other CA. The less entities you have to trust, the better.

DaiPlusPlus 9y ago
> since there is no way to get around trusting SWIFT as a bank I understand banks are free to have some kind of direct-transfer mechanism between them, like internet peering, it would just be redundant. But anyway, I would not trust SWIFT as gatekeepers of banking security. They're a prime example of a business that runs on COBOL written 40 years ago and they're not the paragon of progressive thinking in banking (SWIFT could torpedo Western Union overnight if they really wanted to) and finally, they already have a poor reputation in INFOSEC circles: https://en.wikipedia.org/wiki/2015%E2%80%932016_SWIFT_banking_hack https://en.wikipedia.org/wiki/2015%E2%80%932016_SWIFT_bankin...
pebers 9y ago
Aka. putting all your eggs in one basket... Banks shouldn't be relying on outdated infrastructure providers to do things they aren't good at. The sensible thing (and indeed more or less what happens now) is for banks to choose a best-of-breed CA to issue SSL certs, the same way any other company offering sensitive services over the Internet would do it.
- e12e 9y ago
  > Aka. putting all your eggs in one basket... To a certain extent the alternative here is to put all your eggs in all the baskets - if an elephant steps on any one of the baskets the eggs (your security) breaks...
infinity0 9y ago
That's really not good security logic. It's better to trust a very strong entity for 1/2 of your security and a weak entity for the other 1/2, so that when shit breaks you at least have a more accurate suspicions on which part of your system broke, to start the investigations from. It's much worse to trust a single weak entity for 1/1 of your security. That said, it's possible SWIFT can be a good CA. But you shouldn't choose them if they do a crap job of it, simply to "reduce the number of entities you trust".

DaiPlusPlus 9y ago

> since there is no way to get around trusting SWIFT as a bank I understand banks are free to have some kind of direct-transfer mechanism between them, like internet peering, it would just be redundant. But anyway, I would not trust SWIFT as gatekeepers of banking security. They're a prime example of a business that runs on COBOL written 40 years ago and they're not the paragon of progressive thinking in banking (SWIFT could torpedo Western Union overnight if they really wanted to) and finally, they already have a poor reputation in INFOSEC circles: https://en.wikipedia.org/wiki/2015%E2%80%932016_SWIFT_banking_hack https://en.wikipedia.org/wiki/2015%E2%80%932016_SWIFT_bankin...

pebers 9y ago

Aka. putting all your eggs in one basket... Banks shouldn't be relying on outdated infrastructure providers to do things they aren't good at. The sensible thing (and indeed more or less what happens now) is for banks to choose a best-of-breed CA to issue SSL certs, the same way any other company offering sensitive services over the Internet would do it.

e12e 9y ago
> Aka. putting all your eggs in one basket... To a certain extent the alternative here is to put all your eggs in all the baskets - if an elephant steps on any one of the baskets the eggs (your security) breaks...

infinity0 9y ago

That's really not good security logic. It's better to trust a very strong entity for 1/2 of your security and a weak entity for the other 1/2, so that when shit breaks you at least have a more accurate suspicions on which part of your system broke, to start the investigations from. It's much worse to trust a single weak entity for 1/1 of your security. That said, it's possible SWIFT can be a good CA. But you shouldn't choose them if they do a crap job of it, simply to "reduce the number of entities you trust".