Re: Expired certificate

[Valdis.Kletnieks () vt edu]

On Fri, 16 Jul 2010 20:06:24 +0200, Dimitry Andric said:

> That is definitely not the only reason.  The longer a certificate (or
> actually, any 'secret key') is being used, the larger the probability
> that it will be compromised, either by an opponent brute-forcing it, or
> by good ole' human error.

Of course, a cert that expires once a year for that purpose only really helps
those sites that have been pwned and their secret keys known for months without
the site learning about it.  It used to be "change passwords once a month" to
close down exposures of shoulder-surfed passwords (where an attacker might only
learn 2-3 chars of the password each attempt) and minimize the window a
password could be used (remember, auditing still sucked back in those days).
Doesn't mean it still addresses any real threat in today's environments.  Gene
Spafford wrote some nice articles about this on his blog a while ago:

http://www.cerias.purdue.edu/site/blog/post/password-change-myths/
http://www.cerias.purdue.edu/site/blog/post/passwords-and-myth/

> Another reason is, of course, to guarantee steady income for the
> certificate vendors... ;)

You blew their cover. Now they'll have to kill you. :)

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/