News for hackers. Stuff that matters.

A comment on Private key of DigiCert Certificate Transparency log compromised.

Re:Private key of DigiCert Certificate Transparency log comp... by cjbprime on Thursday May 28, 2020 @10:47AM (#23337931)
As I understand it, this is not a big deal: there are multiple CT servers, and auditors verifying their entries, the design of the system assumes the possibility of compromised log operators.
[ Parent | on HN ]
Re:Private key of DigiCert Certificate Transparency log comp... by some_furry on Thursday May 28, 2020 @10:48AM (#23337939)
Correct. It's an interesting incident, but the consequences for Internet users are pretty much zero.

(Conversely, multiple CT server compromises would be a significant concern, but even then without a compromised Certificate Authority, the impact is almost zero.)

[ Parent | on HN ]
Re:Private key of DigiCert Certificate Transparency log comp... by bawolff on Thursday May 28, 2020 @11:44AM (#23338631)
Well the political consequences are kind of bad. CA system is built around trust. Not being able to secure their servers, even non critical ones, degrades trust.
[ Parent | on HN ]
Re:Private key of DigiCert Certificate Transparency log comp... by cjbprime on Thursday May 28, 2020 @11:49AM (#23338689)
The CT system is built around controlled suspicion, not trust.
[ Parent | on HN ]
Re:Private key of DigiCert Certificate Transparency log comp... by bawolff on Thursday May 28, 2020 @04:41PM (#23342278)
Sure, but if i can't trust someone to run a CT server, why would i trust them to run a CA?
[ Parent | on HN ]
Re:Private key of DigiCert Certificate Transparency log comp... by cjbprime on Thursday May 28, 2020 @06:28PM (#23343651)
It was a 0day in a popular open source package. They didn't do anything wrong. Presumably they use stronger defense in depth, as required by the CA guidelines, to prevent software compromises to the actual CA signing machines. There's no need to go through that level of paranoia for CT log machines.
[ Parent | on HN ]