ocdtrekkie

> Entrust (now Sectigo) is involved with this

This is probably a rough definition for "Entrust was banned from being a CA and sold the business off to a competitor". In part, because I also do not think the root programs would just allow Entrust to continue operating the same business under another brand name, unless they are even dumber than I already thought.

I bet Entrust never made a cert with a private key of 4.

The problem is the death penalty case is aimed at the wrong target: The entire Web PKI system remains dumb and bad, and the correct answer is to dissolve the CA/B and find people with practical security experience.

I defined success for myself quite a few years ago: I want to leave the world better than I found it. No high aspirations, no figure. Just better than it was.

Some of that is political advocacy. Some of that is open source code that should exist. Some of that is helping a neighbor. I don't need to hit a certain bar, I just need to know that in a given interaction or situation, I am trying to make things... at least a little better.

That also scales well to differing life decisions. The video game I'm playing, can I get people to play a little nicer with each other and have more fun? Workplaces are full of dumb stuff, success is making it at least a little better. Turns out I have kids now. Wasn't the plan, but now my obligation is to make sure my involvement in their lives is positive. Not a specific bar I have to achieve, but you know, someday I hope someone appreciates how I chose to live my life.

> support hotline

Have you... ever tried talking to Microsoft support?

Entra ID is separate if you don't want logins from Nigeria. One of the most insane-to-me things is Office 365 is basically "open access by default" and you have to pay $6/month/user to fix it. Most people don't realize just how much attack surface they open up moving their data to the cloud, and that it costs a lot to even start to get back towards a secure environment like you had on-premise.

But yeah, the lock-in effect is huge. Microsoft cloud products deliberately don't work well with anything but more of their own cloud products. And as soon as you start a migration to it based on what you need, you suddenly realize how much other stuff you also need to pay them for. And you can't escape without replacing all of it.

Yeah though FWIW, the overall impact of companies realizing maybe they shouldn't be spending $100k a year on a document editor is likely to raise all boats for alternatives.

It remains really wild people think Office is worth $30/month/user. Anything that erodes that belief is a net positive.

Indeed, and they control the CA/B Forum. The last CA to express an independent and reasonable view got booted from being a trusted CA.

Well, that is the nature of security theater. Busywork and process fragility with no or negative benefit.

In the past a long-lived EV certificate changing was notable/interesting from a security standpoint. Short-lived certificates just mean anyone who can break into your domain registrar (easy) can create an identical certificate and none of your key storage or security matters.

It will merely mean any given legitimate certificate is indistinguishable from a newly minted malicious one.

Because the people on the CA/B Forum is doing security theater and doesn't have a practical view of security risks. But the tech companies that employ them view them as authorities and won't fire them for promoting dumb ideas.

The CA/B is the embodiment of the phrase "if all you have is a hammer, everything looks like a nail".

In theory it can be shorter. Imagine good.cooking is shorter than goodcooking.com

But every one of these plays with all sorts of collisions of user expectations. "word.cloud.microsoft" is one of those URLs that will never look right to me, but is now a corporate staple.

I think more modern security is an "emperor has no clothes" situation than people think. The LLMs are gonna have a field day.

They probably will be the one going through their parents stuff and hopefully by the time its an issue can move it to their kids' place. Options for trusted free hosting are limited sometimes. ;)

100% everything here. That level of tamper evidence should be good enough for the reasonable individual, IMHO.

On the enterprise scale, the question I think everyone should be asking is: Do they have LTO tapes on a shelf? Fundamentally the same issue (but larger), in terms of needing to ensure it's physically separate, and secure, and tamper evident. =)

Anything in the cloud or connected to your network can be hacked. The backup of last resort must be on a shelf.