3 ms·
Why do you think it's a false sense of security? Are you familiar with Certificate Transparency? And Let's Encrypt?
by cjbprime 3y ago
Why do you think it's a false sense of security? Are you familiar with Certificate Transparency? And Let's Encrypt?
- slim 3y agoObviously in this case people trusted Symantec, till they did not. In the mean time thousands of people probably got their computers compromised, and they are still compromised right now. When Google (an opponent) dared to speak out against Symantec, it took years, while people's security was still being compromised, before Microsoft removed the certificate. After removing the certificate, you'd think people are safe, but no Microsoft decided to silently reactivate it for an obscure reason for some time. Now my question is do you use MS Windows ? Do you feel safe, if microsoft can activate a compromised certificate at any time ? What certificate transparency are you talking about, if you have to trust handful of monopolistic companies ? Hierarchical trust is as good as it's trusted authorities. What would happen in the future if you find out that Let's encrypt certificates were compromised like Symantec ?
- cjbprime 3y agoSo the answer is no, you are unfamiliar with Certificate Transparency. You should check it out! It basically solved this problem a long time ago.
- hulitu 3y ago> Are you familiar with Certificate Transparency? You mean when Microsoft, Google, Apple, Cloudfare, Verisign, Digicert say "Trust me" ? Remember Crypto AG ?
- cjbprime 3y ago> You mean when Microsoft, Google, Apple, Cloudfare, Verisign, Digicert say "Trust me" ? No, because that's the opposite of the point of Certificate Transparency. When someone shares a technical term you haven't heard before, you could at least Google it, or ask ChatGPT to explain it, including explaining why it removes the need to trust large corporations to perform cert issuance correctly.