3 ms·
Speaking specifically in terms of compromise, and not in protection against compromise: Certificates are part of a decentralized, delegated trust system. They
by dwaite 7y ago
Speaking specifically in terms of compromise, and not in protection against compromise:
Certificates are part of a decentralized, delegated trust system. They are effectively a cache of a security decision.
With passwords, the security decision is made each time you log in.
If the statement in a certificate is no longer true, you need a mechanism like OCSP stapling (I suppose - because everything else, OCSP and CRLs, have failed).
If your password is compromised, it just needs to be changed in the database or directory. The password won't be usable anymore.
Now, kerberos tickets based on the compromised password may still be good for a few more hours, but thats another story.
- danShumway 7y agoThis is a really good point that I was missing. I kind of assumed that when people talked about the difficulty of de-issuing certificates, they just mean that companies would be slow to do it. The fact that there is no central point of authority by default that can say "no, it's not good anymore" -- that changes a lot of things, because now your expiration date is effectively the only good way to get rid of the certificate. That puts LetsEncrypt's 3 month model in a different light -- it's not just aggressive to force people to automate the renewal process, 3 months is literally just way better than a year for security purposes.