4 ms·
They said in the article they kept the private key to simplify the revokation process. Thus, very likely they also generated the private key. It's a bad practi
by cjalmeida 9y ago
They said in the article they kept the private key to simplify the revokation process. Thus, very likely they also generated the private key.
It's a bad practice promoted by issuers that want to sell a "managed" or "value added" service corporate IT is so fond of. The lesson here is that there's a lot of IT people that don't grasp the basics of key management.
- gesman 9y agoThe road to security hell is paved with intentions to simplify.
- cratermoon 9y agoThat's the most succinct phrasing of the problem of security vs. users (and customers) complaining about what they perceive as the inconvenience and complexity that accompany securing digital assets.
- creeble 9y agoI like to say (and it's not original) that security and convenience are two endpoints of one continuum. You can't get more of one without moving away from the other. There are a few rare near-freebies, but they always have a gotcha. And you'd better understand what they are before taking advantage of them.
- SubiculumCode 9y agoThe road to usability hell is paved with intentions to securify.
- 1001101 9y agoWhy did they need customer private keys for revocation? That didn't make sense to me. [edit: thanks, cjalmeida]
- cjalmeida 9y agoYou need private key for the certificate management protocol. Maybe the had some arrangements for automatic revocation back when Symantec was running the CA. Anyway, you are compromising security over convenience. A trade-off IT should never accept.
- cdancette 9y agoNever is a bit harsh, we're all doing it every day. Why are we still using passwords in 2018? They have been proved unsafe by now.
- cjalmeida 9y agoGranted, but in corporate IT, where stakes are higher, those concession should be minimal. Like, setting up a certificate with only a CSR is server setup 101.
- cdancette 9y agoYes, everything is a matter of finding the right compromise (ofc I agree that sending 23000 private keys over email should never be considered)
- dancek 9y agoYes, they apparently provided a service that generates private keys because that's easier for the customer.