Private key of DigiCert Certificate Transparency log compromised

Re:Private key of DigiCert Certificate Transparency log comp... by rasengan on Thursday May 28, 2020 @10:59AM (#23338062)

> I'm pretty sure the SCT requirement contained the blast radius of this compromise to avoid anyone from actually being affected by it, so your comment doesn't really follow here.

I think this would be true except my statement wasn't just about SCT but the CA system in general. Furthermore, browsers like Firefox [1] do not even have CT checks.

> Also, DANE relies on DNSSEC [1], which is bad.

Handshake completes this system [2].

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1281469

[1a] https://developer.mozilla.org/en-US/docs/Web/Security/Certif...

[2] https://github.com/handshake-org/hdns

[ Parent | on HN ]

Re:Private key of DigiCert Certificate Transparency log comp... by Spivak on Thursday May 28, 2020 @02:02PM (#23340344)

Despite being supported, relying on browsers checking CT logs was never something that what going to be deployed at scale because, just like revocation lists, it adds a performance hurdle to every request.

Auditors and monitors are the real protection you get from CT logs.

You get the same problem with any form of DNS validation because you'll never get every little caching server to validate records.

[ Parent | on HN ]

Re:Private key of DigiCert Certificate Transparency log comp... by tptacek on Friday May 29, 2020 @10:41AM (#23350441)

Just so everyone's clear about this, Handshake is a system backed by a cryptocurrency, "HNS", that is actively traded despite being useful only to speculators. Its backers believe that they'll take over control of the Internet and be rewarded financially for it through their currency.

If that works, I call ARPcoin next.

[ Parent | on HN ]