[bananapub]

dunno why you're being so obnoxious about it?

a month is better than a year because we never ever ever managed to make revocation work, and so the only thing we can do is reduce the length of certs so that stolen or fraudulently obtained certs can be used for less time.

[naasking]

On the vulnerability ladder since SSL was introduced, how common and how disastrous have stolen or fraudulent certs really compared to other security problems, and by how much will these changes reduce such disasters?

[FuriouslyAdrift]

China currently has a large APT campaign using a comprised CA (Billbug).

https://www.darkreading.com/endpoint-security/china-based-bi...

[naasking]

I agree with the article, this is "potentially very dangerous". Potential is not actual though, and I'm asking about what damage has actually materialized. Is there a cost estimate over the past 20 years vs. say, memory safety vulnerabilities?

[capitol_]

Is this some sort of troll comment?

I'm sure that you are perfectly able to do your own research, why are you trying to push that work onto some stranger on the internet?

[naasking]

Is this a troll article? The article asked basically the same question:

    I also wonder how many organizations have had certificates mis-issued due to BGP hijacking. Yes, this will improve the warm fuzzy security feeling we all want at night, but how much actual risk is this requirement mitigating?

Scope creep with diminishing returns happens everywhere.