> That's the same problem we have with server certs, and the general solution seems to be "shorter cert lifetimes". No it isn't, and that's not the reason why

> That's the same problem we have with server certs, and the general solution seems to be "shorter cert lifetimes". No it isn't, and that's not the reason why cert lifetimes are getting smaller. Cert lifetimes being smaller is to combat certs being stolen, not man in the middle attacks.