Comment by BirAdam 14 hours ago or, perhaps you need more so that one being stupid doesn't effect so much. 10 comments BirAdam Reply epanchin 14 hours ago Each CA is like a padlock locked in series with other padlocks. The weakest padlock is the only one that matters. akerl_ 12 hours ago In a world with CT logs and CAA records, is that actually the case? zbentley 12 hours ago Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory. 5 replies → caaqil 14 hours ago > perhaps you need more so that one being stupid doesn't effect so much.So you create more surface area for vulnerability? We might already be at or close to the sweet spot. Security is hard. Gabrys1 13 hours ago I would assume that the client would need to validate the certs against more than 1 trust path (for the comment to make sense)
epanchin 14 hours ago Each CA is like a padlock locked in series with other padlocks. The weakest padlock is the only one that matters. akerl_ 12 hours ago In a world with CT logs and CAA records, is that actually the case? zbentley 12 hours ago Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory. 5 replies →
akerl_ 12 hours ago In a world with CT logs and CAA records, is that actually the case? zbentley 12 hours ago Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory. 5 replies →
zbentley 12 hours ago Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory. 5 replies →
caaqil 14 hours ago > perhaps you need more so that one being stupid doesn't effect so much.So you create more surface area for vulnerability? We might already be at or close to the sweet spot. Security is hard. Gabrys1 13 hours ago I would assume that the client would need to validate the certs against more than 1 trust path (for the comment to make sense)
Gabrys1 13 hours ago I would assume that the client would need to validate the certs against more than 1 trust path (for the comment to make sense)
Each CA is like a padlock locked in series with other padlocks. The weakest padlock is the only one that matters.
In a world with CT logs and CAA records, is that actually the case?
Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory.
5 replies →
> perhaps you need more so that one being stupid doesn't effect so much.
So you create more surface area for vulnerability? We might already be at or close to the sweet spot. Security is hard.
I would assume that the client would need to validate the certs against more than 1 trust path (for the comment to make sense)