4 ms·
We have no real means of revoking certificates whose private keys have leaked. Eventual expiration seems better than nothing. Also, ciphers tend to become obsol
by MaxBarraclough 6y ago
We have no real means of revoking certificates whose private keys have leaked. Eventual expiration seems better than nothing. Also, ciphers tend to become obsolete, so enforcing churn will help keep things moving forward. I'm not an expert here though, there may be other reasons.
- radnom 6y ago> Eventual expiration seems better than nothing. Does it? Because that is the cause of the 'impending doom' from TFA
- grishka 6y agoI feel like if a certificate gets compromised, the fact that it expires in 5 years won't be of any help from the security standpoint. There are already mechanisms in place to revoke certificates before they expire. https://en.wikipedia.org/wiki/Certificate_revocation_list https://en.wikipedia.org/wiki/Certificate_revocation_list https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...