On Sun, August 10, 2014 4:06 pm, Matt Palmer wrote: > On Sat, Aug 09, 2014 at 11:52:16PM -0700, Ryan Sleevi wrote: > > At the risk of engaging what may be trolling behaviour (non-attributable > > email addresses and all that good jazz), and while a point-by-point > > takedown is not particularly worthy, the author makes a number of > > demonstrably false or misleading claims. > > > > 1) That the issuance of certs increases the likelihood of CA compromise. > > Evidence demonstrates the opposite, but either way, they're orthogonal > > issues entirely. Having more certificates issued does not directly make > > it > > more likely for a CA (like DigiNotar) to be breached. > > I'm curious to know what evidence you think demonstrates that issuing more > certificates *reduces* the risk of CA compromise. I would say they *are* > orthogonal issues, but you can't have it both ways -- they're > meta-orthogonal (as it were).
The evidence is that the majority of compromises/CA events in the past several years (DigiNotar, TurkTrust, India CCA, ANSSI ) have been nation-state vanity CAs that issue certificates to small populations. The 'big' CA's events (read: Comodogate, StartSSL) have been significantly more limited in scope, and have been contained, and have been quickly remediated (with quick communication on the CA's behalf) That's not to suggest correlation implies causation, merely that if the author (or David, by virtue of referencing the author) wishes to support such an idea, the evidence runs counter to their conclusion. _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
