3 ms·
PKI doesn’t really help here. The test results weren’t hacked. Essentially an authorized issuer of certificates was itself a bad actor.
by eli 5y ago
PKI doesn’t really help here. The test results weren’t hacked. Essentially an authorized issuer of certificates was itself a bad actor.
- United857 5y agoOne of the features of PKI is that you can revoke the certificate of the malicious issuing authority itself in such cases.
- system2 5y agoThat would be true if the results were 100% computer generated. There are bunch of people behind the computers typing stuff for these reports. User input is the culprit.
- eli 5y agoWhat problem does revoking an old covid test solve?
- United857 5y agoRight now it's trivially easy to fake a paper test cert or CDC vax card and no one can verify them at scale without QR/digital signatures. If an authority was found to be issuing false test results then revoking the issuer's own signing cert by the next level authority, eg the state health department will solve that trust issue.
- eli 5y agoPKI solves other problems but not this one, where people wanted a valid test but the testing facility cheated. Invalidating historical tests isn’t particularly valuable. After they’re more than a few days old the result rarely matter nor be subject to scrutiny. Notifying affected patients is important but they did that just fine with PKI