Hacker News Reader

Comment by mebrainmush | Hacker News Reader

I think a part of the issue was, everyone living outside the walls did not even try to kick the gates open as everyone assumed a big (cryptographically secure) lock was being used by all gatekeepers.

View on HN

https://drmaciver.com/2022/05/learning-to-walk-through-walls...

Citing Terry Pratchett’s “Interesting Times”.

Its called a Potemkin solution, and there is a serious theory that most nuclear arsenals are exactly that: no-one has ever confirmed they can actually be fired.

> no-one has ever confirmed they can actually be fired

that is untrue

In the case of nuclear arsenals that's perfectly fine - MAD simply needs to be plausible, not robustly demonstrated. In the case of CAs I'd argue that the description doesn't really fit since they're getting stress tested by malicious parties on a daily basis. By that logic you could describe linux kernel security as a potemkin village due to the steady stream of zero days. In reality a potemkin village is something intended from the start to deceive everyone else. It's not impossible that's what happened here but that's a very serious allegation to make (ie theorizing that the weak keys were intentional with a conspiracy afoot).

Based on everything with the NSA and backdoors etc, the idea that this was intentional is not inherently implausible.

The reason I agree with you is that it was too obvious i.e. if you were backdoooring something, you would want it to be more difficult to detect than this.

I guess the main takeaway is that the entire Web PKI is a far bigger house of cards than everyone assumes. Ignorance is bliss, I guess.

Reply on news.ycombinator.com