3 ms·
We need to assume a threat model today where Advanced Persistent Threats can seize private keys from hosting providers and US companies. Both secret court order
by zmanian 13y ago
We need to assume a threat model today where Advanced Persistent Threats can seize private keys from hosting providers and US companies. Both secret court orders and hypervizor exploits are part of this threat profile. This threat is greater from smaller companies. Large companies will be better able to resist secret court orders.
- sedev 13y agoI'm not sure that the current track record supports "Large companies will be better able to resist secret court orders." They have more resources that they could use for that, but they also have more to lose. I don't think we've seen evidence that they are resisting those orders - and certainly have seen evidence that, for example, Verizon and AT&T are just handing eavesdroppers everything they want and then some.
- zmanian 13y agoBased on the conversations, I've had with various internet companies lawyers. They consider their private keys to be their crown jewels and they believe the US government would be not be able to keep it secret in the long run if they turned them over.
- Spooky23 13y agoHow do you secure the keys? Smartcards?
- fiatmoney 13y agoYou can buy write-once, use-only SSL modules. Look for "SSL Offload".