← Back to context Comment by BirAdam 13 hours ago or, perhaps you need more so that one being stupid doesn't effect so much. 10 comments BirAdam Reply epanchin 12 hours ago Each CA is like a padlock locked in series with other padlocks. The weakest padlock is the only one that matters. akerl_ 11 hours ago In a world with CT logs and CAA records, is that actually the case? zbentley 10 hours ago Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory. 5 replies → caaqil 12 hours ago > perhaps you need more so that one being stupid doesn't effect so much.So you create more surface area for vulnerability? We might already be at or close to the sweet spot. Security is hard. Gabrys1 11 hours ago I would assume that the client would need to validate the certs against more than 1 trust path (for the comment to make sense)
epanchin 12 hours ago Each CA is like a padlock locked in series with other padlocks. The weakest padlock is the only one that matters. akerl_ 11 hours ago In a world with CT logs and CAA records, is that actually the case? zbentley 10 hours ago Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory. 5 replies →
akerl_ 11 hours ago In a world with CT logs and CAA records, is that actually the case? zbentley 10 hours ago Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory. 5 replies →
zbentley 10 hours ago Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory. 5 replies →
caaqil 12 hours ago > perhaps you need more so that one being stupid doesn't effect so much.So you create more surface area for vulnerability? We might already be at or close to the sweet spot. Security is hard. Gabrys1 11 hours ago I would assume that the client would need to validate the certs against more than 1 trust path (for the comment to make sense)
Gabrys1 11 hours ago I would assume that the client would need to validate the certs against more than 1 trust path (for the comment to make sense)
Each CA is like a padlock locked in series with other padlocks. The weakest padlock is the only one that matters.
In a world with CT logs and CAA records, is that actually the case?
Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory.
5 replies →
> perhaps you need more so that one being stupid doesn't effect so much.
So you create more surface area for vulnerability? We might already be at or close to the sweet spot. Security is hard.
I would assume that the client would need to validate the certs against more than 1 trust path (for the comment to make sense)