4 ms·

100% - another for the BGP hijack!

• michaelt 2y ago
  The current CAB Forum Baseline Requirements call for "Multi-Perspective Issuance Corroboration" [1] i.e. make sure the DNS or HTTP challenge looks the same from several different data centres in different countries. By the end of 2026, CAs will validate from 5 different data centres. This should make getting a cert via BGP hijack very difficult. [1] https://github.com/cabforum/servercert/blob/main/docs/BR.md#3229-multi-perspective-issuance-corroboration https://github.com/cabforum/servercert/blob/main/docs/BR.md#...
  • tialaramex 2y ago
    It is hypothesised to make this more difficult but it's unclear how effective it is in practice. I wouldn't expect it to make a significant difference. We've been here before.
  • iscoelho 2y ago
    See my post above about BGP hijacks: https://news.ycombinator.com/item?id=41511582 https://news.ycombinator.com/item?id=41511582 - They're way easier than you think.