4 ms·
This. They don’t even use a HSM if I understood correctly and using one is not part of the mitigation plan. Not OK.
by ahoka 3y ago
This. They don’t even use a HSM if I understood correctly and using one is not part of the mitigation plan. Not OK.
- lazide 3y agoHSM’s are super inconvenient obviously, and as Mr. Robot showed not perfect. So why bother? /s
- jnsaff2 3y agoApparently they might also be backdoored by the NSA: https://news.ycombinator.com/item?id=37571014 https://news.ycombinator.com/item?id=37571014
- lazide 3y agoStill probably better than having the private key part of a random core dump from a random developer. :s That’s just embarrassing.
- jnsaff2 3y agoNo doubt. My expectations to MS engineering are really low so I'm unfortunately not shocked.
- grotorea 3y agoFrankly is this important? If the NSA is a threat to you do you have any business trusting MS?
- lazide 3y agoNo one has any business trusting Microsoft, apparently? I’m under no delusions that an intelligence agency with ‘home team advantage’ wouldn’t already have the keys to the kingdom. If they are in the apparent habit of leaving the keys sitting around in random Cafes, the odds that other non-home team intelligence agencies have a copy increases dramatically too. Or even random miscreants. As to if that matters? Eh.
- reilly3000 3y agoThey sure sell HSM on Azure.