3 ms·
On the vulnerability ladder since SSL was introduced, how common and how disastrous have stolen or fraudulent certs really compared to other security problems,
by naasking 1y ago
On the vulnerability ladder since SSL was introduced, how common and how disastrous have stolen or fraudulent certs really compared to other security problems, and by how much will these changes reduce such disasters?
- FuriouslyAdrift 1y agoChina currently has a large APT campaign using a comprised CA (Billbug). https://www.darkreading.com/endpoint-security/china-based-billbug-apt-infiltrates-certificate-authority https://www.darkreading.com/endpoint-security/china-based-bi...
- naasking 1y agoI agree with the article, this is "potentially very dangerous". Potential is not actual though, and I'm asking about what damage has actually materialized. Is there a cost estimate over the past 20 years vs. say, memory safety vulnerabilities?
- capitol_ 1y agoIs this some sort of troll comment? I'm sure that you are perfectly able to do your own research, why are you trying to push that work onto some stranger on the internet?
- naasking 1y agoIs this a troll article? The article asked basically the same question: I also wonder how many organizations have had certificates mis-issued due to BGP hijacking. Yes, this will improve the warm fuzzy security feeling we all want at night, but how much actual risk is this requirement mitigating? Scope creep with diminishing returns happens everywhere.