25 ms·
> all of this is a huge mess that's probably trivial to compromise? That's a bold claim. I think you should prove it otherwise it's just FUD. By prove it, I m
by jcoffland 8y ago
> all of this is a huge mess that's probably trivial to compromise?
That's a bold claim. I think you should prove it otherwise it's just FUD. By prove it, I mean perform an exploit and documented it. That's the only way things get better.
- peterwwillis 8y agoIt's not FUD when you have a list of incidents (https://community.letsencrypt.org/c/incidents https://community.letsencrypt.org/c/incidents) and it's not FUD just because I don't have 0days sitting around. If this is just the incidents from one CA, and assuming this is an example of best effort, there would naturally be many more, and possibly worse, exploits gone unnoticed on the hundreds of other CAs.
- schoen 8y agoOnly three of those incidents were described by LE as resulting in misissuance under its CPS: https://community.letsencrypt.org/t/blocklist-incident-november-21-2016/23008 https://community.letsencrypt.org/t/blocklist-incident-novem... https://community.letsencrypt.org/t/2018-05-18-caa-tag-value-case-sensitivity-incident/62232 https://community.letsencrypt.org/t/2018-05-18-caa-tag-value... https://community.letsencrypt.org/t/caa-check-incident-december-7-2015/9633 https://community.letsencrypt.org/t/caa-check-incident-decem... Of these, I believe that none were issued to entities that didn't actually control or operate the sites described by the certificates.