TRANSCRIPTIE 🔗
1
00:00:00,000 --> 00:00:04,880
In my opinion, this is either on par or worse
2
00:00:04,880 --> 00:00:06,240
than the PHP thing.
3
00:00:06,240 --> 00:00:10,520
The entire thing here, in my opinion,
4
00:00:10,520 --> 00:00:15,520
goes beyond negligence to purposeful weakening
5
00:00:16,480 --> 00:00:17,320
of a control.
6
00:00:17,320 --> 00:00:19,860
That little lock icon on your browser
7
00:00:19,860 --> 00:00:22,000
is not just there to look reassuring.
8
00:00:22,000 --> 00:00:24,920
It's your browser asking, is this really my bank
9
00:00:24,920 --> 00:00:26,840
or just a very good fake?
10
00:00:26,840 --> 00:00:28,320
So this week on the podcast,
11
00:00:28,320 --> 00:00:30,560
we're talking about how Emudra
12
00:00:30,560 --> 00:00:33,800
issued intermediate CA keys so weak
13
00:00:33,800 --> 00:00:36,600
that researchers could easily recreate them.
14
00:00:36,600 --> 00:00:39,280
Now that did not break the entire internet,
15
00:00:39,280 --> 00:00:41,960
but it was serious enough for platforms
16
00:00:41,960 --> 00:00:44,320
to revoke trust and for Emudra
17
00:00:44,320 --> 00:00:47,720
to actually exit the global TLS business.
18
00:00:47,720 --> 00:00:49,520
So on the show today,
19
00:00:49,520 --> 00:00:51,920
we'll explain why certificate authorities
20
00:00:51,920 --> 00:00:53,820
and public keys are the trust system
21
00:00:53,820 --> 00:00:56,920
behind the sites and apps we use every day
22
00:00:56,920 --> 00:01:00,800
and why weak keys can put that trust at risk.
23
00:01:00,800 --> 00:01:04,440
And joining me for this conversation are two people
24
00:01:04,440 --> 00:01:08,120
I know that would never make their private key,
25
00:01:08,120 --> 00:01:12,360
the number four, Scott Wright and Kevin Tackett.
26
00:01:12,360 --> 00:01:14,280
Has to be at least two digits.
27
00:01:14,280 --> 00:01:15,120
One digit.
28
00:01:15,120 --> 00:01:17,880
The sentence you did in the introduction,
29
00:01:17,880 --> 00:01:21,040
it caused them to exit is the same thing as
30
00:01:21,040 --> 00:01:23,200
no, you can't fire me, I quit.
31
00:01:23,200 --> 00:01:24,400
I mean, basically.
32
00:01:25,160 --> 00:01:28,160
Yeah, like, why did we let them put their tail
33
00:01:28,160 --> 00:01:32,080
between their legs and slunk out of the, the internet?
34
00:01:32,080 --> 00:01:32,920
I don't know.
35
00:01:32,920 --> 00:01:34,200
What would you propose, Kevin?
36
00:01:34,200 --> 00:01:35,240
Yeah.
37
00:01:35,240 --> 00:01:36,840
I personally believe that we should.
38
00:01:40,510 --> 00:01:42,790
With or without warning?
39
00:01:42,790 --> 00:01:45,750
Well, I think this was warning enough.
40
00:01:45,750 --> 00:01:51,030
Oh, here's the thing that PHP overshadowed this.
41
00:01:51,030 --> 00:01:52,430
Yes, it did.
42
00:01:52,430 --> 00:01:53,950
And that's why I'm bringing it up.
43
00:01:53,950 --> 00:01:54,910
Yeah.
44
00:01:54,950 --> 00:01:55,950
And I appreciate that.
45
00:01:55,950 --> 00:02:02,190
In my opinion, this is either on par or worse than the PHP thing.
46
00:02:02,190 --> 00:02:04,710
We can talk about chain guard being idiots
47
00:02:04,710 --> 00:02:07,590
and breaking the contract and the embargo and all that kind of thing.
48
00:02:07,790 --> 00:02:11,750
And the sheer number of LinkedIn ads I get about chain guard now
49
00:02:11,750 --> 00:02:15,630
that they prove that they're untrustworthy, in my opinion.
50
00:02:15,830 --> 00:02:18,870
But the image or how I'm not even sure
51
00:02:18,870 --> 00:02:20,630
if that's how you pronounce it, I'm sorry.
52
00:02:20,630 --> 00:02:21,830
No, I'm not sorry.
53
00:02:21,830 --> 00:02:24,030
They don't deserve to be pronounced correctly.
54
00:02:24,030 --> 00:02:30,710
The entire thing here, in my opinion, goes beyond negligence
55
00:02:31,590 --> 00:02:35,030
to purposeful weakening of a control.
56
00:02:35,390 --> 00:02:36,390
Very big control.
57
00:02:36,390 --> 00:02:37,590
Generating. I'm sorry.
58
00:02:37,590 --> 00:02:39,030
Pretty big control.
59
00:02:39,030 --> 00:02:39,750
Right.
60
00:02:39,750 --> 00:02:43,910
The generating of these private keys are not done.
61
00:02:44,430 --> 00:02:47,950
This is not like and this is something I've seen a lot of people misunderstand.
62
00:02:48,550 --> 00:02:50,790
There is a process to generate keeps.
63
00:02:51,510 --> 00:02:57,110
That process would not generate a key of four.
64
00:02:58,190 --> 00:03:01,150
Period. It just doesn't work that way.
65
00:03:01,150 --> 00:03:03,830
It can't work that way, right?
66
00:03:04,110 --> 00:03:10,190
And so what that means is somebody edited or generated this key
67
00:03:10,390 --> 00:03:12,590
not through that process.
68
00:03:12,590 --> 00:03:14,630
Did they mean to set it to four?
69
00:03:14,630 --> 00:03:16,150
I don't know.
70
00:03:16,150 --> 00:03:19,030
But somebody had to go touch this.
71
00:03:19,630 --> 00:03:24,350
Somebody had to make this mistake or do this on purpose.
72
00:03:24,790 --> 00:03:30,350
So now what I think should be looked at is who caused that to happen.
73
00:03:30,910 --> 00:03:35,870
We could go everywhere from a government agency forced them to weaken.
74
00:03:35,870 --> 00:03:38,590
I mean, we've talked about this forever about government agencies
75
00:03:38,590 --> 00:03:40,310
trying to weaken encryption.
76
00:03:40,310 --> 00:03:41,910
That could have been what happened here.
77
00:03:41,910 --> 00:03:45,510
I mean, we can go conspiracy, not fake moon landing
78
00:03:46,510 --> 00:03:52,710
under the Earth's civilizations and reptiles generating these private keys.
79
00:03:52,710 --> 00:03:57,230
If you want, I think I've just messed with the entire algorithm for our podcast.
80
00:03:57,230 --> 00:04:01,750
Oh, man, we're screwed if you monetize to get you.
81
00:04:01,750 --> 00:04:04,750
I don't believe this was an accident
82
00:04:05,670 --> 00:04:08,750
that followed processes the way they're saying it, right?
83
00:04:08,950 -->
Load full transcript
00:04:12,710
Before they there's the Mozilla bug that has an interesting thread
84
00:04:13,350 --> 00:04:16,350
before the claim was well for safety and security.
85
00:04:16,350 --> 00:04:19,150
We have to take this private up to that point.
86
00:04:19,150 --> 00:04:23,190
Everything was being said as, well, this was an error in the process
87
00:04:23,190 --> 00:04:24,190
and it wasn't that big a deal.
88
00:04:24,190 --> 00:04:26,750
And that is bluntly false.
89
00:04:27,110 --> 00:04:28,430
Yeah. Patent.
90
00:04:28,430 --> 00:04:32,390
So so maybe let's let's talk about, first of all, like before, I mean,
91
00:04:32,590 --> 00:04:35,230
yeah, the issue with the key, it was a weak key, right?
92
00:04:35,230 --> 00:04:37,230
Number four, very, very bad.
93
00:04:37,790 --> 00:04:40,590
But I think for our audience, like, I think we want to frame
94
00:04:40,790 --> 00:04:45,750
the importance of what exactly happened and why this is so serious.
95
00:04:45,790 --> 00:04:51,270
And I think we need to discuss how certificates work in your web browser
96
00:04:51,510 --> 00:04:54,390
and around public key cryptography.
97
00:04:54,750 --> 00:04:59,150
Let's explain what is the certificate chain in our web browsers
98
00:04:59,150 --> 00:05:01,230
and why this is so serious.
99
00:05:01,630 --> 00:05:04,190
The simplest way I'm always used to explain this is
100
00:05:04,790 --> 00:05:08,590
when I go to a website, let's say I go to securities.com.
101
00:05:08,830 --> 00:05:12,510
That has an SSL certificate, a TLS certificate, whatever,
102
00:05:13,070 --> 00:05:16,510
to encrypt traffic between the browser and the server.
103
00:05:17,070 --> 00:05:19,510
It allows that encrypted traffic to go.
104
00:05:19,790 --> 00:05:23,470
You know, what it allows us to say with some level of confidence,
105
00:05:23,990 --> 00:05:28,390
I'm talking to the right organization and my communication is private.
106
00:05:28,670 --> 00:05:33,750
OK. And I say some level of confidence because we have no way to say
107
00:05:33,790 --> 00:05:38,990
I, Kevin, trust the web server at securities.com
108
00:05:38,990 --> 00:05:41,630
to hand me the right certificate and be the right thing.
109
00:05:41,870 --> 00:05:48,110
What I do is my web browser has a list of certifying
110
00:05:48,110 --> 00:05:51,030
authorities or CAs. We hear this all the time.
111
00:05:51,230 --> 00:05:56,830
And basically my browser trusts those CAs.
112
00:05:56,990 --> 00:06:02,230
It believes that anything signed by the CA is legitimate.
113
00:06:02,550 --> 00:06:06,590
OK. And so when I get a certificate from a web server,
114
00:06:06,750 --> 00:06:12,470
I don't trust that cert that certificate has been signed by a CA.
115
00:06:13,030 --> 00:06:17,790
I trust the CA. The CA trusts that server.
116
00:06:18,310 --> 00:06:20,550
And so it's what trend they did trust.
117
00:06:20,550 --> 00:06:24,790
I must trust the cert because I trust the CA and the CA trusts them.
118
00:06:25,190 --> 00:06:28,990
OK. And this is entirely based on the idea
119
00:06:29,310 --> 00:06:35,310
that the trust in the CA is inviolate or however the word is pronounced.
120
00:06:36,030 --> 00:06:39,110
When, you know, with signatures and stuff like that,
121
00:06:39,110 --> 00:06:42,630
the way we do this, the way that we trust it is the idea that we have
122
00:06:42,630 --> 00:06:49,190
a private key that nobody but approved people here know.
123
00:06:49,550 --> 00:06:52,590
And we use that private key to sign the certificate.
124
00:06:52,830 --> 00:06:58,670
Basically, the private key is supposed to be
125
00:06:58,670 --> 00:07:01,230
mathematically complex.
126
00:07:01,670 --> 00:07:06,990
In this case, the key was literally the number four.
127
00:07:06,990 --> 00:07:09,830
When I first read it, I thought they were saying I know it was a joke.
128
00:07:09,870 --> 00:07:11,990
You was four bites.
129
00:07:11,990 --> 00:07:16,110
Yeah, which I'm much better.
130
00:07:16,990 --> 00:07:20,230
Right. But but in this case, like, for example,
131
00:07:20,230 --> 00:07:25,430
because I know what the private key is, I literally can create a certificate
132
00:07:25,670 --> 00:07:29,230
and find it as trusted by a mudger.
133
00:07:29,390 --> 00:07:31,470
Yes. And so I could build a website.
134
00:07:32,150 --> 00:07:33,870
Well, OK, I'll stop using the example.
135
00:07:33,870 --> 00:07:35,950
Security is because I control that domain.
136
00:07:35,950 --> 00:07:37,070
So of course I can.
137
00:07:37,070 --> 00:07:39,230
But but let's say Bank of America.
138
00:07:39,230 --> 00:07:43,910
I can build a website pretending to be Bank of America
139
00:07:44,590 --> 00:07:50,510
and finding the quote unquote Bank of America certificate as a mudger
140
00:07:50,750 --> 00:07:52,590
because I know their private key.
141
00:07:52,630 --> 00:07:55,390
Now, it will only work now if you haven't
142
00:07:55,390 --> 00:07:57,710
upgraded your browser and your browser doesn't have it right.
143
00:07:57,710 --> 00:08:02,310
Like, but but we all know that people don't patch, don't upgrade, don't do stuff.
144
00:08:02,510 --> 00:08:07,830
So this will be a threat, especially in areas where we're not
145
00:08:07,830 --> 00:08:10,870
upgrading as fast, where people are having problems.
146
00:08:12,270 --> 00:08:15,390
Is that these certificates are now known.
147
00:08:15,590 --> 00:08:19,870
The private keys are known so anybody can sign and say,
148
00:08:19,950 --> 00:08:23,030
I'm the C.A.E. mudger or however you say it.
149
00:08:23,630 --> 00:08:25,790
And I trust this sir.
150
00:08:26,310 --> 00:08:29,630
So we've we've completely undermined the trust chain.
151
00:08:30,150 --> 00:08:32,110
So yeah, make that answer the question.
152
00:08:32,110 --> 00:08:34,030
That's a great way to describe it.
153
00:08:35,910 --> 00:08:38,470
Mobile apps are just part of everyday life now.
154
00:08:38,830 --> 00:08:41,990
Banking, health
care, shopping, entertainment, you name it.
155
00:08:41,990 --> 00:08:45,750
And with that comes a lot of trust because users are putting
156
00:08:45,750 --> 00:08:48,470
their personal data directly into your app.
157
00:08:48,710 --> 00:08:49,830
But here's the reality.
158
00:08:49,830 --> 00:08:51,750
Mobile apps are a growing target.
159
00:08:52,030 --> 00:08:55,270
A recent survey found that 72 percent of organizations
160
00:08:55,270 --> 00:08:58,750
experienced a mobile app security incident last year.
161
00:08:58,750 --> 00:09:02,390
And 92 percent say threats are only increasing.
162
00:09:02,510 --> 00:09:06,030
And the way attackers are going after apps is pretty sophisticated.
163
00:09:06,110 --> 00:09:08,910
They're reverse engineering them, modifying them
164
00:09:08,910 --> 00:09:12,190
and redistributing fake versions through fishing campaigns,
165
00:09:12,390 --> 00:09:15,390
side loading and even third party app stores.
166
00:09:15,790 --> 00:09:20,190
So from a user's perspective, everything can look completely legitimate.
167
00:09:20,430 --> 00:09:24,430
That's why taking a proactive approach to mobile app security really matters.
168
00:09:24,590 --> 00:09:28,550
You want to stay ahead of these threats, not react after the damage is done.
169
00:09:28,870 --> 00:09:30,790
This is where Guard Square comes in.
170
00:09:30,790 --> 00:09:34,350
They provide advanced protection for both Android and iOS apps,
171
00:09:34,630 --> 00:09:38,830
along with automated security testing to catch vulnerabilities early
172
00:09:39,150 --> 00:09:43,670
and real time threat monitoring so you can actually see what's happening out there.
173
00:09:43,790 --> 00:09:47,510
If your mobile app is critical to your business, and it probably is,
174
00:09:47,790 --> 00:09:50,030
this is something worth paying attention to.
175
00:09:50,190 --> 00:09:52,870
You can learn more at GuardSquare.com.
176
00:09:52,990 --> 00:09:55,070
That's GuardSquare.com.
177
00:09:56,990 --> 00:10:01,030
And just to add that Emodra is not a root certificate.
178
00:10:01,030 --> 00:10:03,910
And so we could talk about the difference between root and intermediate
179
00:10:03,910 --> 00:10:07,950
certificates. So Emodra is a intermediate certificate.
180
00:10:08,430 --> 00:10:13,190
So to your point, yes, you could impersonate another domain
181
00:10:13,470 --> 00:10:16,870
and then you would inherently get the trust of the root CA.
182
00:10:16,990 --> 00:10:19,910
And so that's the biggest issue.
183
00:10:20,070 --> 00:10:24,150
And Scott, you actually worked for a root CA back in the day, right?
184
00:10:24,510 --> 00:10:28,310
And trust? Not one of the original ones, but it was and trust and trust.net
185
00:10:28,310 --> 00:10:32,550
had its own probably still does have its own root authority.
186
00:10:33,390 --> 00:10:35,950
Which was actually, yeah, it took a while.
187
00:10:35,950 --> 00:10:39,470
They were originally an intermediate authority until they got embedded.
188
00:10:39,830 --> 00:10:42,430
The thing that's interesting about this whole thing that started
189
00:10:42,430 --> 00:10:46,510
in the late 1990s with the first browsers like that was before.
190
00:10:46,870 --> 00:10:49,950
But yeah, Netscape communicator or navigator, whatever it was, right?
191
00:10:50,230 --> 00:10:54,110
What's interesting is that was kind of, in my mind, the first block chain
192
00:10:54,190 --> 00:10:58,270
because there was a chain of signed certificates that you could follow.
193
00:10:58,430 --> 00:11:03,030
So your your key was signed by your intermediate CA
194
00:11:03,030 --> 00:11:07,350
and that was signed by the root CA and that root CA was put into the browser
195
00:11:07,870 --> 00:11:09,310
and everybody got the browser.
196
00:11:09,350 --> 00:11:11,950
So everybody would get the public key of that root CA
197
00:11:11,950 --> 00:11:14,750
and they can understand whether to trust it or not.
198
00:11:14,750 --> 00:11:18,070
And I think that's how I'm not sure, but I think that's how those free browsers
199
00:11:18,070 --> 00:11:19,270
made their money, right?
200
00:11:19,270 --> 00:11:23,110
They charged for for the CAs to put their root
201
00:11:23,470 --> 00:11:27,430
e-certificates, not the keys themselves, because I hear a lot of people
202
00:11:28,430 --> 00:11:32,390
on podcasts talking about, well, they got their they published
203
00:11:32,390 --> 00:11:34,750
their keys or their private keys.
204
00:11:34,750 --> 00:11:36,030
No, they don't publish the private keys.
205
00:11:36,030 --> 00:11:39,270
They published only the certificate and the certificate
206
00:11:39,270 --> 00:11:41,910
contains an enshrined public key.
207
00:11:41,910 --> 00:11:46,310
So you you can always encrypt for or verify somebody's signature.
208
00:11:46,350 --> 00:11:51,630
But all that to say, there's a lot of a lot riding on, first of all,
209
00:11:51,630 --> 00:11:56,310
the randomness and complexity of those private keys
210
00:11:56,310 --> 00:12:00,190
that are used to create the certificates in the first place, right?
211
00:12:00,190 --> 00:12:05,230
And then the privacy of it to make sure that nobody gets access to it.
212
00:12:05,230 --> 00:12:10,150
And usually when those keys are created, the private part of the key pair
213
00:12:10,390 --> 00:12:13,190
is taken offline and nobody can ever get to it of it.
214
00:12:14,310 --> 00:12:15,750
Locks in a safe.
215
00:12:15,750 --> 00:12:17,030
Yeah, exactly.
216
00:12:17,030 --> 00:12:21,630
And so you don't want someone to be able to replicate, you know,
217
00:12:21,790 --> 00:12:23,990
one way to get that private key is to steal it.
218
00:12:24,630 --> 00:12:28,510
The other way is to guess it and get it right and be able to verify it
219
00:12:28,510 --> 00:12:29,750
with the certificate, right?
220
00:12:29,750 --> 00:12:33,310
And when you use the number four, you can verify that you've got
221
00:12:33,310 -->
00:12:34,470
the right number pretty quickly.
222
00:12:34,470 --> 00:12:36,750
So I think that's kind of what it comes down to.
223
00:12:37,230 --> 00:12:41,630
This is going back over 20 years in my memory from how public key
224
00:12:41,630 --> 00:12:42,510
cryptography worked.
225
00:12:42,510 --> 00:12:45,950
But, you know, blockchain is a lot like how those things work.
226
00:12:46,230 --> 00:12:49,350
But I think, you know, as Kevin said, I thought it was a really
227
00:12:49,350 --> 00:12:53,990
interesting idea Kevin had that because it was such a, you know,
228
00:12:53,990 --> 00:12:56,790
it's not that of all the random numbers you generate,
229
00:12:56,790 --> 00:12:58,430
you couldn't come up with the number four.
230
00:12:58,430 --> 00:13:00,630
It's just as likely to recur as any other number.
231
00:13:00,750 --> 00:13:05,190
But the way it's put in that format was probably very suspicious,
232
00:13:05,190 --> 00:13:08,990
right? As Kevin said, it's like, OK, maybe it was intentional.
233
00:13:08,990 --> 00:13:12,750
I can imagine, you know, a disgruntled employee because I can't
234
00:13:12,750 --> 00:13:16,470
see the government forcing them to do it that way because they
235
00:13:16,470 --> 00:13:18,590
would just be too suspicious, right?
236
00:13:19,270 --> 00:13:22,790
I think if somebody really was angry with the company and they
237
00:13:22,790 --> 00:13:24,670
got, you know, they're going to get laid off or whatever.
238
00:13:24,870 --> 00:13:26,830
And they're part of the key generation ceremony.
239
00:13:27,110 --> 00:13:29,390
They say, oh, I'm not going to use this big random number
240
00:13:29,390 --> 00:13:31,230
that we just generated. I'm going to use the number four.
241
00:13:31,230 --> 00:13:32,990
And that'll that'll show them.
242
00:13:32,990 --> 00:13:38,150
Well, they said that the the issue was a key generation error
243
00:13:38,150 --> 00:13:43,990
created by weak keys alongside intended strong P3384 keys.
244
00:13:44,990 --> 00:13:47,430
Some kind of mess up with the labels or something.
245
00:13:47,430 --> 00:13:49,750
They gave some explanation, but I.
246
00:13:49,750 --> 00:13:50,790
It took the wrong field.
247
00:13:50,790 --> 00:13:52,590
It took an index field instead of.
248
00:13:52,590 --> 00:13:56,630
Yeah. And I looked for is they gave some excuses.
249
00:13:56,750 --> 00:13:57,790
Yeah. That's what it sounds like.
250
00:13:58,030 --> 00:13:59,830
Yes. Exactly.
251
00:13:59,830 --> 00:14:03,630
Because this, I mean, for this is the first case that I think
252
00:14:03,630 --> 00:14:08,110
I've ever seen of this ever happening and like this is
253
00:14:08,110 --> 00:14:11,670
something that is so routine, right?
254
00:14:11,670 --> 00:14:15,510
That this and there's so many different intermediate CAs
255
00:14:15,510 --> 00:14:18,070
that are out there. I just find it shocking.
256
00:14:18,070 --> 00:14:20,630
And I think the whole industry does find the shocking
257
00:14:20,630 --> 00:14:21,550
that this actually happened.
258
00:14:21,550 --> 00:14:23,670
And in fact, there's people making T-shirts.
259
00:14:23,870 --> 00:14:26,910
And if you've seen those T-shirts, Kevin, the RSA
260
00:14:27,030 --> 00:14:31,710
key starts for RS key at private key end, right?
261
00:14:31,830 --> 00:14:33,070
Like I want one of those.
262
00:14:33,070 --> 00:14:34,990
Hilarious. So we all want one of those shirts.
263
00:14:35,030 --> 00:14:37,950
And so from a user and an organization perspective,
264
00:14:37,950 --> 00:14:42,190
obviously Microsoft has already revoked the eMudra
265
00:14:42,190 --> 00:14:44,350
certificates that has already been done.
266
00:14:44,350 --> 00:14:46,670
This is why it's very important that you update your web
267
00:14:46,670 --> 00:14:47,710
browsers, right?
268
00:14:47,750 --> 00:14:51,910
This issue has been resolved, but there is that window of
269
00:14:51,910 --> 00:14:52,790
time, right?
270
00:14:52,790 --> 00:14:56,470
That if an attacker knew about this, or if this
271
00:14:56,510 --> 00:14:57,910
happens in the future, right?
272
00:14:57,910 --> 00:15:02,430
We now you know that attackers will be testing intermediate
273
00:15:02,430 --> 00:15:04,750
CAs for this type of issue.
274
00:15:04,750 --> 00:15:06,670
Now that we know it's happened once, right?
275
00:15:06,670 --> 00:15:08,830
And it can happen most likely again.
276
00:15:08,830 --> 00:15:11,230
Unfortunately, I don't think we've ever had an episode
277
00:15:11,230 --> 00:15:14,870
where we've talked about how the security of a web
278
00:15:14,870 --> 00:15:17,710
browser and how the certificate chaining works
279
00:15:17,710 --> 00:15:21,070
and why that is so important, right?
280
00:15:21,070 --> 00:15:24,310
It's to everything that we do with a web browser on
281
00:15:24,310 --> 00:15:26,710
the internet. And it's all based on public key
282
00:15:26,710 --> 00:15:27,390
cryptography.
283
00:15:27,390 --> 00:15:29,470
Little much to cover in a 20 minute podcast.
284
00:15:29,470 --> 00:15:30,070
Yeah, exactly.
285
00:15:30,070 --> 00:15:32,190
But but you know, a little bit, a little bit.
286
00:15:32,190 --> 00:15:35,550
But and we won't talk about like, you know, someone
287
00:15:35,550 --> 00:15:38,470
posted, I think on Twitter, I saw Matt Johansson post
288
00:15:38,470 --> 00:15:42,470
this about like, oh, AI is going to break public key
289
00:15:42,470 --> 00:15:43,430
cryptography.
290
00:15:43,430 --> 00:15:45,110
I'm like, OK, just stop.
291
00:15:45,110 --> 00:15:48,350
Let's let's just let's just stop already.
292
00:15:48,390 --> 00:15:50,030
No, but quantum computers will.
293
00:15:50,030 --> 00:15:51,990
Well, quantum is a whole other thing.
294
00:15:51,990 --> 00:15:52,950
Yeah. Yeah.
295
00:15:53,750 --> 00:15:57,590
Yeah, maybe we can have another episode about quantum
296
00:15:57,590 --> 00:16:01,910
and how that can and probably will affect encryption
297
00:16:01,910 --> 00:16:04,590
overall. But the way that you use the web browser
298
00:16:04,590 --> 00:16:07,430
and you browse to websites, you know, the certificate
299
00:16:07,430 --> 00:16:10,350
chaining is so important to that and the backbone
300
00:16:10,350 --> 00:16:12,910
of all of internet security, essentially.
301
00:16:13,470 --> 00:16:15,990
Actually, it wouldn't be a bad idea to have an episode
302
00:16:15,990 --> 00:16:18,390
on quantum safe computing and quantum safe
303
00:16:18,390 --> 00:16:20,070
cryptography at some point.
304
00:16:20,070 --> 00:16:22,150
I have to have a talk I've given a few times.
305
00:16:22,190 --> 00:16:25,310
It does. This is this is a topic that the browser
306
00:16:25,310 --> 00:16:29,070
should be in is such a topic that we, you know, people
307
00:16:29,070 --> 00:16:32,350
like us that have been around for a while, remember back
308
00:16:32,350 --> 00:16:34,830
when I mean, like the original way to get an SSL
309
00:16:34,830 --> 00:16:37,270
certificate was very difficult.
310
00:16:37,270 --> 00:16:40,390
Yeah, you had to prove this massive amount of stuff.
311
00:16:40,750 --> 00:16:44,750
And that slowly changed over time to the point
312
00:16:44,750 --> 00:16:48,270
where now people just kind of take that for granted.
313
00:16:48,270 --> 00:16:49,350
But don't you still have.
314
00:16:49,350 --> 00:16:51,230
And you used to have a Dunn & Bradstreet number
315
00:16:51,270 --> 00:16:52,310
or something like that to get it?
316
00:16:52,310 --> 00:16:55,270
Yeah, yeah, if you if you wanted to, if you wanted
317
00:16:55,270 --> 00:16:58,830
a company certificate, a certificate added to a company,
318
00:16:58,830 --> 00:17:02,870
a Dunn's number was was a way to get that.
319
00:17:03,630 --> 00:17:06,310
You know, I mean, I remember I had to provide
320
00:17:07,510 --> 00:17:11,590
partnership agreements where like the internal documents
321
00:17:11,590 --> 00:17:15,150
forming the company to get a certificate and a letter
322
00:17:15,150 --> 00:17:18,270
from a bank that said we absolutely had that the bank
323
00:17:18,310 --> 00:17:22,630
account was the company is not just like it was ridiculous.
324
00:17:22,910 --> 00:17:26,350
Understandably, so based on what I accomplished with it.
325
00:17:26,870 --> 00:17:30,150
Yeah. And then that became less onerous.
326
00:17:30,390 --> 00:17:34,390
And then people got sent about that to the the CAs added
327
00:17:34,830 --> 00:17:38,150
services. Well, oh, you want an extended validation
328
00:17:38,150 --> 00:17:40,950
cert. And the first time I went through the EV validation,
329
00:17:40,950 --> 00:17:44,190
if you guys remember that, it was the exact same questions
330
00:17:44,190 --> 00:17:47,550
I had answered the previous version.
331
00:17:47,630 --> 00:17:51,630
It was just now considered the higher standard.
332
00:17:51,630 --> 00:17:53,510
It was nuts. I will admit, I was angry.
333
00:17:54,750 --> 00:17:59,070
Yes. Yes. Well,
we're we're old grumpy old men, right?
334
00:17:59,070 --> 00:18:03,630
Back in my day, we had to show a passport to get a certificate.
335
00:18:05,110 --> 00:18:08,270
Yeah. But now, you know, nowadays it is like, in fact,
336
00:18:08,470 --> 00:18:11,150
you don't even have to pay for an SSL cert anymore, right?
337
00:18:11,150 --> 00:18:13,830
Like, yeah, there's three CAs, but you can't they won't
338
00:18:13,830 --> 00:18:15,870
be embedded in the browser. That's all.
339
00:18:16,470 --> 00:18:17,870
Right. Yeah, exactly.
340
00:18:17,870 --> 00:18:20,310
Like if you are an intermediates or a route, right?
341
00:18:20,310 --> 00:18:22,230
That's very different, absolutely.
342
00:18:22,230 --> 00:18:25,030
So, Scott, real quick, we talked about the book last episode,
343
00:18:25,030 --> 00:18:26,270
but it is out there.
344
00:18:26,270 --> 00:18:29,030
It is available now for sale, right?
345
00:18:29,030 --> 00:18:30,950
It's not free anymore. It's no nine cents.
346
00:18:31,430 --> 00:18:32,350
Oh, hold on.
347
00:18:32,350 --> 00:18:34,470
Sales have dropped off as a means of all.
348
00:18:34,470 --> 00:18:36,830
But yeah, the digital legacy tree,
349
00:18:36,830 --> 00:18:40,950
ensuring your loved ones can get access to the important parts
350
00:18:40,950 --> 00:18:43,870
of your digital life when it's most important.
351
00:18:43,870 --> 00:18:46,750
So that's that's what the book is.
352
00:18:46,750 --> 00:18:49,790
And would love to have people pick it up at Amazon.
353
00:18:49,790 --> 00:18:52,310
The Kindle version is available right now.
354
00:18:52,790 --> 00:18:56,230
And looking for people to give reviews, that would be great.
355
00:18:56,470 --> 00:19:00,830
Yeah, pick up his book for 99 cents and give a review.
356
00:19:00,910 --> 00:19:03,230
If you can, Scott would really appreciate it.
357
00:19:03,430 --> 00:19:05,030
All right. All right.
358
00:19:05,030 --> 00:19:07,590
Well, Kevin, hopefully we get to see you again here
359
00:19:07,590 --> 00:19:09,630
in the next few weeks, right?
360
00:19:09,630 --> 00:19:11,990
I have one more trip this year and that's it.
361
00:19:12,110 --> 00:19:14,550
Yeah, I should wind in the travel down.
362
00:19:14,750 --> 00:19:17,110
It would be different. Yeah. Yes. Yes.
363
00:19:17,150 --> 00:19:19,990
All right. Well, thank you all for listening.
364
00:19:19,990 --> 00:19:24,230
And until next time, stay safe, stay secure and stay privates.
365
00:19:24,910 --> 00:19:29,750
Private key, privates or thank you for listening or watching.
366
00:19:29,910 --> 00:19:32,510
If you like this episode, hit subscribe,
367
00:19:32,710 --> 00:19:34,550
share it with your friends and colleagues
368
00:19:34,550 --> 00:19:37,870
or jump into our community at shared security dot net
369
00:19:37,870 --> 00:19:40,510
slash supporter to keep the conversation going.
370
00:19:40,630 --> 00:19:42,830
Thanks again, and we'll see you next week
371
00:19:42,830 --> 00:19:45,310
for another episode of shared security.