3 ms·
I would bat an eye because it's never good to rely on a single point of failure. Imagine, for instance, that at some point, LE is the only trusted CA for code-
by majewsky 8y ago
I would bat an eye because it's never good to rely on a single point of failure.
Imagine, for instance, that at some point, LE is the only trusted CA for code-signing. If its root key gets compromised for some reason, how are we supposed to move to a new CA if the auto-updaters cannot trust the old CA anymore?
- sam0x17 8y agoTrue. They should maybe consider breaking up their operation into 20 or so root certs.
- sterlind 8y agoAs much as I'm tempted to agree, decentralization perhaps risks even more. Opsec compromise is only one SPOF for a signing service; the state might coerce the CA into handing over the keys or issuing an intermediate for MitM. Do you shard across 20 nations? If so, you have to contend with 20 intelligence agencies. It might make more sense to keep all the eggs in one basket, and have new baskets ready to go if a canary triggers.