Re:Distrusting StartSSL
by tptacek on Saturday April 12, 2014 @06:28PM
(#7579449)
Very few people will actually have lost privkeys. Patching your server is a much more important countermeasure than revocation. Certificate revocation in practice works nowhere nearly as well as it does on paper; in fact, it comes dangerously close to not working at all. Read Adam Langley's (jaundiced) take on OCSP for more details.
Long story short: certificate revocation is probably not a big enough deal for Start to somehow be required to rewrite the terms you agreed to when you acquired your certs from them.
Re:Distrusting StartSSL
by tptacek on Saturday April 12, 2014 @07:08PM
(#7579535)
Yup. So soft-fail revocation checks are like a seat-belt that snaps when you crash. Even though it works 99% of the time, it's worthless because it only works when you don't need it.
Long story short: certificate revocation is probably not a big enough deal for Start to somehow be required to rewrite the terms you agreed to when you acquired your certs from them.