Full Disclosure mailing list archives
Re: Expired certificate
From: Marsh Ray <marsh () extendedsubset com>
Date: Tue, 20 Jul 2010 11:55:32 -0500
On 07/17/2010 11:23 AM, Dan Kaminsky wrote:
-- but imagine if drives *intentionally* committed suicide one day after warranty expire. People would go nuts! Somehow, this is all OK in X.509.
The usual logic given for this and other types of mandatory password expiration schemes is that it limits the time of exposure when the credentials are compromised. These days this reasoning makes less sense when the attacker might only need to use his unauthorized access for 50ms or so to install a persistent backdoor. Still, unless you really expect people to trust a certificate that's been sitting on some web server for 10 years, there's going to have to be some kind of expiration. Drivers licenses, (as Pavel said) passports, most kinds of real-world credentials expire. In the computer field we deal with 10+ orders of magnitude on the time axis (10 years vs 100 ms) so normal policies don't scale well. So we question what seems perfectly reasonable to ordinary people and they figure we've just lost our common sense. Operationally, it just shouldn't be that big a deal to schedule a maintenance every few years. Like expiring domain registrations, the hardest part is simply to not lose track of it. The Accounting dept in an organization can sometimes help to not forget that stuff. - Marsh _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Expired certificate, (continued)
- Re: Expired certificate Valdis . Kletnieks (Jul 16)
- Re: Expired certificate Jan Schejbal (Jul 21)
- Re: Expired certificate Ryan Castellucci (Jul 22)
- Re: Expired certificate Junk Meat (Jul 16)
- Re: Expired certificate bk (Jul 16)
- Re: Expired certificate Junk Meat (Jul 16)
- Re: Expired certificate bk (Jul 16)
- Re: Expired certificate Junk Meat (Jul 17)
- Re: Expired certificate Dan Kaminsky (Jul 17)
- Re: Expired certificate Pavel Kankovsky (Jul 18)
- Re: Expired certificate Marsh Ray (Jul 20)
- Re: Expired certificate Dan Kaminsky (Jul 22)
- Re: Expired certificate Marsh Ray (Jul 22)
- Re: Expired certificate Dan Kaminsky (Jul 22)
- Re: Expired certificate Marsh Ray (Jul 22)
- Re: Expired certificate bk (Jul 23)
- Re: Expired certificate bk (Jul 16)
- Re: Expired certificate Meadow (Jul 23)
- Re: Expired certificate Marsh Ray (Jul 24)
- Re: Expired certificate Pavel Kankovsky (Jul 24)
- Re: Expired certificate Dan Kaminsky (Jul 24)
- Re: Expired certificate Dan Kaminsky (Jul 24)