PKI problem: who we actually trust
summary
Default device CA bundles contain ~150 root certificates so any one of many governments, post offices or telcos can sign for any domain. Real incidents include Kazakhstan's repeated attempts to push national roots and a 2023 Jabberwock case where attackers got a LetsEncrypt cert and remained unnoticed for 60 days undetected. Practical steps: inspect and drop anything strange from ca-bundles, avoid free AV/VPNs that install CAs, and for high-value apps pin the certificate.
AI-written summary · about
chapters (8)
- 0:00PKI trust problems
- 2:30PKI chains of trust
- 3:13Untrusted root certificates
- 4:16Certificate misuse cases
- 5:41Reducing trust risks
- 7:08Certificate pinning
- 8:11Root CA permission model
- 14:20Isolation strategies
related talks
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
40mDigital Identities - 21 PKI Pitfalls and How Best to Avoid Them
30mPKI Well Revised: Common Mistakes Which Lead to Huge Compromise of Identity
56mIoT: Taking PKI Where No PKI Has Gone Before
31mPKI the Wrong Way: Simple TLS Mistakes and Surprising Consequences
36mYou Like It Or Not; You Need It! - PKI And Certificate Management
16mJust trust me - public key infrastructure in less than twelve minutes
38mPKI deployments are as unique as any snowflake; how to build equally flexible PQ migration strategie