4 ms·
> I leave it to the reader to imagine how automated decision making would play out here Could you elaborate? Many other services have automated revocation, eit
by Ukv 2y ago
> I leave it to the reader to imagine how automated decision making would play out here
Could you elaborate? Many other services have automated revocation, either through scanning for exposed keys or offering an endpoint to submit keys to, and as far as I can tell the way it has played out is in successful warning of and prevention of many leaks. I don't see how lack of it can be justified as a "security" measure.
- loa_in_ 2y agoIMO it's going to result in a potential DoS by submitting guesses en masse, denying whole revoking whole company's access until key renewal.
- Ukv 2y agoKeys should have sufficient bits of entropy to not be guessable. And if a malicious actor can guess a key, you should want it revoked as opposed to them doing more serious damage through other endpoints.