3 ms·
> I stopped sending compromised key notifications to CAs. Instead, now I’m publishing the details of compromised certificates to everyone, so that users can pro
by hunter2_ 3y ago
> I stopped sending compromised key notifications to CAs. Instead, now I’m publishing the details of compromised certificates to everyone, so that users can protect themselves directly
If this is most feasible, ok, though it smells like the opposite of responsible disclosure. Perhaps I'm just not in tune with the nature of how this threat differs from a typical software vulnerability, and therefore the responsible disclosure method I'm familiar with is irrelevant.
- doesnt_know 3y agoThe surrounding text explains that several CAs didn’t like having to spend resources doing revocations and intentionally made the disclosure process more onerous. Responsible disclosure is a courtesy that should not be extended to bad faith actors.
- profmonocle 3y ago> though it smells like the opposite of responsible disclosure He's not sharing the key itself, just proof that it's been leaked. Unlike disclosing a security issue without warning, this disclosure doesn't give any bad actors and power they didn't already possess. (Because any bad actors who have the key would already know what TLS certs it matches, or could trivially find out by querying CT logs themselves.)
- hunter2_ 3y agoThank you!
- hsbauauvhabzb 3y agoEven with the key, from what I can tell it’s fairly hard to exploit for the average netizen.
- some_furry 3y ago> If this is most feasible, ok, though it smells like the opposite of responsible disclosure. Read: https://adamcaudill.com/2015/11/19/responsible-disclosure-is-wrong/ https://adamcaudill.com/2015/11/19/responsible-disclosure-is...