3 ms·
Why is compromise of a cert that can sign ".moo.bar.foo.baz.com" so* much worse than compromise of one that can sign "www.moo.bar.foo.baz.com"?
by peteretep 12y ago
Why is compromise of a cert that can sign ".moo.bar.foo.baz.com" so* much worse than compromise of one that can sign "www.moo.bar.foo.baz.com"?
- carey 12y agoThe compromise of technet.microsoft.com, while a very big deal, would be an order of magnitude worse if it was *.microsoft.com.
- Dylan16807 12y agoHow so? The update mechanisms use certificate pinning, and even if they didn't it sounds like an argument to use different certificates for code signing and for web servers. What other problems could there have been? Most people are only going to verify that it's microsoft.com.