3 ms·
My guess? They worked with the CEO to discuss the issue. Then recommended hiring some consulting company that specializes in key management. The consultant s
by jcampbell1 13y ago
My guess? They worked with the CEO to discuss the issue. Then recommended hiring some consulting company that specializes in key management. The consultant says something like, you need to keep a copy of the keys in an offsite vault for disaster recover purposes. The NSA now has the keys.
It is also possible they just got the keys from spies. In my company, anyone with sudo access to front end machines can get the keys. I have no idea how to keep these keys secure from the NSA.
- kniht 13y agoYou should look into how perfect forward secrecy works in TLS before you make these kinds of claims. [1] http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se...
- vidarh 13y agoIf someone has your private cert and keys, that is irrelevant - they can fully MITM you. Forward secrecy only ensures that a compromised key doesn't compromise data collected in the past.