[Bimi] Fwd: Problematic cert activities

[Wei Chuang <[e-mail]>]

---------- Forwarded message ---------
*From: *Dave Crocker <[e-mail]>
*Date: *Sun, Mar 31, 2019 at 4:33 PM
*Subject: *Re: [Bimi] Problematic cert activities
*To: *Wei Chuang <[e-mail]>


On 3/31/2019 4:18 PM, Wei Chuang wrote:
> With regards to VMC, in theory there's a face-to-face validation step to
> could mitigate this though that is only done on the initial request.
> I'll have to check if subsequent certificate requests are vulnerable or
> if other measures protect against this type of attack.


In an unrelated, and relatively random conversation today, I had a bit
of insight that is no doubt obvious to serious security folk but hadn't
occurred to me:  We have the concept of 2FA, with two independent
channels that provide validation of the requestor. But we ought to add
the idea of two-factor confirmation.  So rather than just sending an
email to confirm that the owner of the cited email address agrees with
whatever the transaction is, do a second, separation confirmation -- eg,
via the phone number.

The set of attack behaviors described by Bill are such that I doubt this
would have made a difference -- there were more basic holes being
exploited -- but I suspect there is value to be had with it.

The broader point is that we seem not to take a holistic approach to
protection of infrastructure services...


> PS Sorry for the delay in getting back to this as I was in transit.

Delay?  There was a delay? ...


d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net