Re:Maintaining digital certificate security
by jpollock on Tuesday July 08, 2014 @03:28PM
(#8006261)
If more than one signature was allowed on a certificate, then sites would be able to have more than one path to the root. Then it wouldn't matter if any single CA was removed, giving people time to obtain new signatures.
[ Parent
| on HN ]
Re:Maintaining digital certificate security
by graylights on Tuesday July 08, 2014 @05:20PM
(#8006802)
Agreed, but I think it should go a step further. Browsers should require 2 signatures from different regions. That way a government can't pressure a single CA within their borders to issue rogue certs. 2 signatures would be minimum with 3 for redundancy.
Re:Maintaining digital certificate security
by AlyssaRowan on Wednesday July 09, 2014 @03:43AM
(#8008511)
Agreed: this is a major operational flaw with deployed PKIX.
It has many unintended consequences, for example it's especially a pain with UEFI Secure Boot.