3 ms·
IMO you are a fool if you think every USA-based CA has not been NSLed for their private keys. I am saying it is impossible to know so good OpSec demands we assu
by Lammy 6y ago
IMO you are a fool if you think every USA-based CA has not been NSLed for their private keys. I am saying it is impossible to know so good OpSec demands we assume the worst. Feel free not to act accordingly, but I will act like all TLS is broken all the time.
- randomhodler84 6y agoAnd now you are being offensive — This is a wild claim, and use of HSMs would prevent simply handing keys over in such cases. The most popular CA is let’s encrypt, it is offensive to claim that they are compromised, or that they have not taken steps to build a system that was difficult to compromise. One could argue they could be compelled to sign an arbitrary csr, however this would be detected by the CT infrastructure, and a big deal when discovered. You are free to act like everything is in the clear of course, but don’t cast negative FUD on good projects that actively protect the world. Trying to convince the world TLS trust system is hopeless broken is a very dangerous conspiracy theory to be peddling.
- Lammy 6y agoI support your right to discern your own risk level and act accordingly, and I hope you will allow me the same. After all, the fool is both the highest and lowest-value card :)