15 ms·

There's another aspect of this situation that also discredits the system: that they can just go out and get a different cert from another vendor. How many such

There's another aspect of this situation that also discredits the system: that they can just go out and get a different cert from another vendor. How many such vendors are there? How long would it take for an actual bad actor to have all their certs discovered and revoked? If that time is long, then the certification process is of even more dubious value, since the bad guys would not be materially hindered by the certification requirement.

gruez 6y ago
"Security-in-depth": https://news.ycombinator.com/item?id=24193087 https://news.ycombinator.com/item?id=24193087
- asdfasgasdgasdg 6y ago
  On some level I get it but aren't cash cards a thing? What actual level of identity and KYC do these cert companies do? How easy is it for someone without scruples to get another cert without revealing their identity? (Genuine questions: I do not personally know.)
  - deburr 6y ago
    Cash cards can be distinguished against at the merchant level by most payment providers (and often are to prevent delayed charge fraud).
tgsovlerkhgsel 6y ago
The job of a certificate authority is to verify an identity, not to vet that the holder is using the certificate only for good. As long as the CAs do that job (which is a separate issue), it's fine if John Doe can get 50 different CAs to certify that he is, indeed, John Doe.
- ecdavis 6y ago
  Take a look at the "Baseline Requirements for the Issuance and Management of Code Signing Certificates"[0] - specifically section 13.1. Here's the most relevant excerpt: > A CA MUST revoke a Code Signing Certificate in any of the four circumstances: (1) the Application Software Supplier requests revocation, (2) the subscriber requests revocation, , (3) a third party provides information that leads the CA to believe that the certificate is compromised or is being used for Suspect Code, or (4) the CA otherwise decides that the certificate should be revoked. [0] https://cabforum.org/baseline-requirements-code-signing/ https://cabforum.org/baseline-requirements-code-signing/
- asdfasgasdgasdg 6y ago
  Plainly whoever is issuing the cert we're discussing sees their role as much broader. Presumably the OS manufacturer also sees it that way.

gruez 6y ago

"Security-in-depth": https://news.ycombinator.com/item?id=24193087 https://news.ycombinator.com/item?id=24193087

asdfasgasdgasdg 6y ago
On some level I get it but aren't cash cards a thing? What actual level of identity and KYC do these cert companies do? How easy is it for someone without scruples to get another cert without revealing their identity? (Genuine questions: I do not personally know.)
- deburr 6y ago
  Cash cards can be distinguished against at the merchant level by most payment providers (and often are to prevent delayed charge fraud).

tgsovlerkhgsel 6y ago

The job of a certificate authority is to verify an identity, not to vet that the holder is using the certificate only for good. As long as the CAs do that job (which is a separate issue), it's fine if John Doe can get 50 different CAs to certify that he is, indeed, John Doe.

ecdavis 6y ago
Take a look at the "Baseline Requirements for the Issuance and Management of Code Signing Certificates"[0] - specifically section 13.1. Here's the most relevant excerpt: > A CA MUST revoke a Code Signing Certificate in any of the four circumstances: (1) the Application Software Supplier requests revocation, (2) the subscriber requests revocation, , (3) a third party provides information that leads the CA to believe that the certificate is compromised or is being used for Suspect Code, or (4) the CA otherwise decides that the certificate should be revoked. [0] https://cabforum.org/baseline-requirements-code-signing/ https://cabforum.org/baseline-requirements-code-signing/
asdfasgasdgasdg 6y ago
Plainly whoever is issuing the cert we're discussing sees their role as much broader. Presumably the OS manufacturer also sees it that way.