Hacker News Reader

Ok, I didn't realize that. But it still doesn't solve the problem of compromising an old certificate and creating a fake signature with your own time.

View on HN

A timestamp authority is trusted in the same way that a certificate signing authority is, so you'd have to compromise a timestamp authority as well as the private keys paired with the certificate. A self-timestamped file would have the same level of trust as a file signed with a self-signed certificate.

Expired and compromised are two different things. If compromised, it will be published in a CRL with a reason flag.

The reason why certificates expire is because they will become easy to crack as computers get faster. So this would effectively be removing the expiry date. Now you can crack any old certificate and sign things claiming that you did it before the certificate expired.

As someone above has already said.

To do this, you'd need to compromise or convince a trusted timestamping authority to sign your signing request with an old date.

Reply on news.ycombinator.com