Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Crypto breaks are a concern for sure, but typically the more short-term concern is server compromise. Cert revocation is not reliably checked by all clients, and sites may not even know to revoke it.

So it's essential that if/when a bad guy pops a single server that they don't get a secret that allows them to conduct further attacks against the site for some indefinite period into the future.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: