4 ms·
In my method no one knows the key. In the article, you have the key in an env variable. In particular, if someone prebuilds the keys for you, he/she has you key
by ecesena 8y ago
In my method no one knows the key. In the article, you have the key in an env variable. In particular, if someone prebuilds the keys for you, he/she has you key.
- jiveturkey 8y ago> In the article, you have the key in an env variable. Only during the moment of provisioning. > In particular, if someone prebuilds the keys for you, he/she has you key. You have a similar weakness. If someone prebuilds the keys, you don't know if they are loading a fixed key. You also have the problem of not knowing if the attestation cert is actually trustworthy, or where else the key for that cert might live.