5 ms·
Mixed comments in the github issue. I can definitely see how shorter lifetimes provide better security, but I have also run into my fair share of issues caused
by null0pointer 2y ago
Mixed comments in the github issue. I can definitely see how shorter lifetimes provide better security, but I have also run into my fair share of issues caused by cert expiry. Do we have good data around the lead time between someone’s signing keys being compromised and their use in an attack? The shorter that lead time the less useful this change is.
- gruez 2y ago>Do we have good data around the lead time between someone’s signing keys being compromised and their use in an attack? Given how fast it is to set up a phishing proxy, such "lead time" is probably measured in hours rather than days. Even something like a 1 week expiry will provide security benefits.