3 ms·
No company should be incentivising companies to not revoke compromised certificates. Even if the cost is modest. It's more about not patronizing a company with
by clinta 11y ago
No company should be incentivising companies to not revoke compromised certificates. Even if the cost is modest. It's more about not patronizing a company with such a bad business model than it is about the dollar cost.
- currysausage 11y agoStartSSL's business model: making things free that don't cost them measurable money, and charging for transactions that cost them money. An exception from that rule in the wake of Heartbleed would arguably have been appropriate, but the business model as such is in no way bad. If the whole SSL industry worked in a way that put price and cost in proportion, there would be no need for Let's Encrypt.
- Karunamon 11y agoHow does an automated revocation cost them money?
- currysausage 11y agohttps://blog.cloudflare.com/the-hard-costs-of-heartbleed/ https://blog.cloudflare.com/the-hard-costs-of-heartbleed/
- mikeash 11y agoWhat about every other certificate issuer, whose up-front fees incentivize companies to not encrypt data in the first place?
- clinta 11y agoNot encrypting is better than not revoking a compromised certificate. A compromised certificate gives the user the impression that the connection is secure when it's security is compromised. A plaintext connection makes no false claims.
- mikeash 11y agoIn which case if you don't want to pay for revocation, you could just revert back to an unencrypted connection.