4 ms·
As far as I know it is intended to prevent identity abuse in both the IRL sense as cryptographic sense. It means that it is harder for an attacker to abuse you
by oneplane 6y ago
As far as I know it is intended to prevent identity abuse in both the IRL sense as cryptographic sense.
It means that it is harder for an attacker to abuse your systems or key material to sign something in your name.
Perhaps the best analogy I can come up with is the dns-01 verification with ACME and a lower TTL. You need to compromise more pieces of the puzzle on a shorter timeline to attack that specific part of the system.
- saagarjha 6y agoCode signing was always a thing, and you can sign your code without notarizing it. And in fact notarization doesn't really seem to have much to do with the person who wrote the thing you are notarizing–you can notarize other people's software!