nmelo

When a GPU training server gets compromised, the first question is always: what credentials were on that box, and where could they go? SSH keys scattered across hundreds of nodes. Service accounts with static secrets. Nobody knows exactly what exists on which machines.

Hardware-attested credentials eliminate this question. Credentials bound to verified hardware cannot be extracted or moved. The trust anchor is silicon, not software.

We heard from a few sec engineers in our team that's there's no great open database of security incidents

Over the past 2 months a few people in my team have been manually building one from public data. It's in early stages, but plan to keep it free.

Interesting concept! For the JS snippet, what's the performance impact? I've had some past experiences with third-party scripts slowing down our page loads

Absolutely. The important part is that certificates don't necessarily need to encode any personal information to be immediately useful as a factor of authentication. The fact that a person controls the private key associated with the certificate should be enough to allow any given server to trust the certificate, if they have enough confidence that the private key is being securely stored by the user.

Now extend that to a personal certificate authority. As long as the server is able to trust that the Root Certificate, and any Intermediates certs in that CA are controlled by the user, they should be able to trust certificates signed by that CA to authenticate that person.

In the same way a self-signed certificate doesn't need to be signed by an official root of trust to be useful for authentication, a self-signed Personal CA doesn't need to be signed or cross-signed by another CA to be trusted by a server.

TJ Jermoluk used to be CEO of @Home Networks, President and COO at Silicon Graphics and General Partner at KPCB.

CommandScape | Software Engineers | Palm Beach, FL | ONSITE, Fulltime, http://commandscape.com

CommandScape is a startup in South Florida with working to provide fully secure integrated Building Management Systems (Automated Buildings and Homes). The company is building advanced hardware and software systems that use Internet-standard cyber security throughout to manage, monitor, and automate the essential needs of a commercial building or private residence. The products employ a single suite of intuitive and easy-to-use applications that work transparently and securely from anywhere in the world.

All of the above?