On Fri, 16 Jul 2010 20:06:24 +0200, Dimitry Andric said: > That is definitely not the only reason. The longer a certificate (or > actually, any 'secret key') is being used, the larger the probability > that it will be compromised, either by an opponent brute-forcing it, or > by good ole' human error.
Of course, a cert that expires once a year for that purpose only really helps those sites that have been pwned and their secret keys known for months without the site learning about it. It used to be "change passwords once a month" to close down exposures of shoulder-surfed passwords (where an attacker might only learn 2-3 chars of the password each attempt) and minimize the window a password could be used (remember, auditing still sucked back in those days). Doesn't mean it still addresses any real threat in today's environments. Gene Spafford wrote some nice articles about this on his blog a while ago: http://www.cerias.purdue.edu/site/blog/post/password-change-myths/ http://www.cerias.purdue.edu/site/blog/post/passwords-and-myth/ > Another reason is, of course, to guarantee steady income for the > certificate vendors... ;) You blew their cover. Now they'll have to kill you. :)
pgpVN7b0V4A71.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/