3 ms·
Since key revocation is fundamentally broken it's the difference between having a limited time period where you're exposed and being exposed until the cert actu
by Xylakant 12y ago
Since key revocation is fundamentally broken it's the difference between having a limited time period where you're exposed and being exposed until the cert actually expires.
- chetanahuja 12y ago"Since key revocation is fundamentally broken" Do you mean SSL key revocation in general broken or in this proposed solution by cloudflare. If it's the former, would you care to elaborate how it's broken?
- agwa 12y agoWhy the former is broken: https://www.imperialviolet.org/2014/04/19/revchecking.html https://www.imperialviolet.org/2014/04/19/revchecking.html https://www.imperialviolet.org/2014/04/29/revocationagain.html https://www.imperialviolet.org/2014/04/29/revocationagain.ht...
- chetanahuja 12y agoAhh... now I remember reading/hearing about the OSCP ineffectiveness and stapling etc. a few weeks ago (after watching Ilya Grigorik's talk "is ssl fast already" or something like that). Thanks for the reminder.