2 ms·
The cert would verify that a specific individual signed the email, with someone having previously verified issuing the credential to the right person (this sort
by chipsa 5y ago
The cert would verify that a specific individual signed the email, with someone having previously verified issuing the credential to the right person (this sort of thing is usually issued as a smart card ID, so it's used for several things, and it's unlikely people lose it without reporting it lost and getting it revoked).
- giantg2 5y agoThey specifically mentioned issuing themself one, not stealing one.
- chipsa 5y agoYeah, issuing themself one through RAPIDS. You need to authenticate against RAPIDS to issue one. So you're looking at stealing a credential, and hoping you can get it done before it's noticed it's gone and revoked, and hoping that they don't go ahead and look at logins between when it was last seen and when it was revoked in order to see if there's any weirdness, at which point your credential gets revoked. If they did something similar for law enforcement, it would probably have the same sort of restrictions: you need to authenticate to get a credential, but to authenticate you need a credential. So you need to steal one to issue yourself one.