https://www.spreaker.com/podcast/root-causes-a-pki-and-security-podcast--3406724enSociety & CultureCopyright Tim Callanhttps://d3wo5wojvuv7l.cloudfront.net/t_rss_itunes_square_1400/images.spreaker.com/original/ecacfe8353659a8c4d9ec597fd2e9467.jpghttps://www.spreaker.com/podcast/root-causes-a-pki-and-security-podcast--3406724Fri, 04 Sep 2026 13:17:47 +0000Tim CallanTim Callanfeeds@spreaker.comPodcast by Tim Callan and Jason Sorokofalse387e8a22-20ba-536b-aaf6-7fe15047e705episodichttps://www.spreaker.com/episode/root-causes-661-what-will-happen-with-eidas-and-mtc--748986447bae9d28-8c3d-455b-9f35-3e2160baf33aFri, 04 Sep 2026 13:02:00 +0000Tim CallanTLS certificates from CA/Browser Forum CAs are not the only server certificates in the WebPKI. eIDAS QWACs are treated as server certificates by the major browsers. We see clear progress toward post quantum cryptography (PQC) for TLS by way of the...651merkle tree certificates (mtc),post quantum cryptography (pqc,webpkifalse662fullhttps://www.spreaker.com/episode/root-causes-660-what-are-delegated-credentials--7481306781f4df0f-c1bd-48fe-91d1-86b6b502e904Wed, 02 Sep 2026 13:55:48 +0000Tim CallanAs certificate lifespans become extremely short, new methods of delivery become functionally necessary. We explain RFC 9345 and how delegated credentials play a role in CDNs to deliver very short-lived certificates.188webpkifalse661fullhttps://www.spreaker.com/episode/root-causes-659-should-we-lengthen-certificate-lifespans--747688037bc3da22-cb1b-4e02-8fcd-c592e3e6f879Mon, 31 Aug 2026 13:53:42 +0000Tim CallanWith certificate lifespans shortening, we occasionally run into those who disagree with this trend and seek to lengthen maximum term once again. We examine regressive attitudes in PKI, why they occur, and the reasons that lessening security is...747webpkifalse659fullhttps://www.spreaker.com/episode/root-causes-658-the-trouble-with-x9-certificates--747001476e7e809f-8309-40c0-af52-f3c0bfa9428fWed, 26 Aug 2026 16:59:14 +0000Tim CallanX9 is a consortium certificate for interbanking applications. There is a common misunderstanding that X9 certificates are a public-trust surrogate for mTLS using WebPKI certificates. We clarify why this is not the case.781webpki,x9false658fullhttps://www.spreaker.com/episode/root-causes-657-what-is-chaos-engineering--746505789d3f54c3-938e-4d2a-9cb6-1285740159d2Mon, 24 Aug 2026 15:34:55 +0000Tim Callan"Chaos engineering" describes the practice of injecting faults into a system to see what happens. This is a known strategy for deterministic systems, but with the advent of non-deterministic AI systems, chaos engineering has taken on greater importance.114cybersecurityfalse657fullhttps://www.spreaker.com/episode/root-causes-656-the-trouble-with-recursive-ai-training--744601886d9e5427-645c-4f82-b8ad-430849bae172Fri, 21 Aug 2026 13:46:13 +0000Tim CallanSince frontier-model AIs have been trained on a large portion of published human knowledge, widespread publication of incorrect information can taint AI results. As more AI-generated slop finds its way onto the internet, this runs the risk of further...370ai (artificial intelligence)false656fullhttps://www.spreaker.com/episode/root-causes-655-why-not-to-create-your-own-private-ca--7434042642bc65a9-036a-4888-a2ea-e8b94044ede2Wed, 19 Aug 2026 20:42:28 +0000Tim CallanIt is possible to use common tools like OpenSSL to create your own ML-DSA private CA. This is a great tool for development and research projects, but Jason explains the pitfalls with trying to do this for production systems.360pkifalse655fullhttps://www.spreaker.com/episode/root-causes-654-what-s-the-difference-between-ml-dsa-and-ml-kem--7420890113aa265c-cf17-4ed5-a556-aafdf84384d5Mon, 17 Aug 2026 13:18:19 +0000Tim CallanWe are replacing RSA with the combination of ML-DSA and ML-KEM. We explain the naming convention and specifically what these two algorithms do.422post quantum cryptography (pqcfalse654fullhttps://www.spreaker.com/episode/root-causes-653-post-quantum-civilization--73982225fd3d0e71-1a57-4eb4-8f00-83814f7ad3e3Fri, 14 Aug 2026 12:17:51 +0000Tim CallanJason explains de-quantization, which is the practice of using our knowledge of how to use a quantum computer to reframe problems for processing using traditional computing architecture.450post quantum cryptography (pqcfalse653fullhttps://www.spreaker.com/episode/root-causes-652-choosing-webpki-deprecation-dates--738948744d725213-eb9f-4082-8afe-58c7d8b13079Wed, 12 Aug 2026 00:00:00 +0000Tim CallanThere is no CABF or root program rule preventing public CAs from implementing new requirements earlier than their assigned due dates. We discuss reasons to implement a rule early and how early it should be.640webpkifalse652fullhttps://www.spreaker.com/episode/root-causes-651-look-at-a-calendar--737614061e2f7042-fd1d-4430-8f87-915c00ed235aMon, 10 Aug 2026 13:20:41 +0000Tim CallanIt is surprising that we continue to see root expirations occur at the most inopportune times. Weekends, public holidays, even New Year's Eve. In this episode we have simple advice to anybody setting up a new root, which is "look at a calendar."332pki,webpkifalse651fullhttps://www.spreaker.com/episode/root-causes-650-is-it-time-to-stop-saying-ssl--7375891527fcfef3-511a-4aeb-9fb8-648f6598360aFri, 07 Aug 2026 00:00:00 +0000Tim CallanSSL hasn't been a standard in use for nearly thirty years, but we still use the word. We discuss why that is, what else we might say, and the expected effect of Merkle Tree Certificates (MTC) on our technical vocabulary.466ssl / tls,webpkifalse650fullhttps://www.spreaker.com/episode/root-causes-649-client-authentication-certificate-use-cases--73508772d0198c8d-002a-4ecf-a97f-4c105fffdaa4Wed, 05 Aug 2026 17:36:48 +0000Tim CallanWith the upcoming deprecation of client authentication using publicly trusted TLS certificates, we go over the common use cases for these certificates. We discuss the reasons public trust is often chosen and how to transition away from it.675pkifalse649fullhttps://www.spreaker.com/episode/root-causes-648-claude-mythos-discovers-new-hawk-and-aes-attacks--733940078929269d-64a6-4720-8cea-9fc7d93f4435Mon, 03 Aug 2026 15:53:11 +0000Tim CallanAnthropic recently announced that Mythos has found mathematical weakness in the core algorithm for the third-round NIST PQC candidate HAWK, effectively halving its effective key strength. Mythos also developed a faster attack on a round-reduced...1289aes,ai (artificial intelligence),post quantum cryptography (pqcfalse648fullhttps://www.spreaker.com/episode/root-causes-647-ad-cs-certighost-flaw-highlights-agentic-identity-risks--7328380291d68806-2c79-46ca-9c6a-387090179965Fri, 31 Jul 2026 13:19:32 +0000Tim CallanA newly revealed flaw in Active Directory Certificate Services (AD CS) allows an attacker to improperly obtain cryptographic credentials for an agent. We discuss the implications that this flaw Certighost (pronounced sert-uh-GHOST) has for agentic AI...1154agentic ai,pkifalse647fullhttps://www.spreaker.com/episode/root-causes-646-clarifying-the-dates-for-clientauth-deprecation--73237972c29a899f-2b3a-4b99-9e34-5af164a506fcWed, 29 Jul 2026 14:47:28 +0000Tim CallanBecause of a change in the drop-dead date, we have observed confusion in the timeline for deprecation of client authentication and mTLS for public TLS certificates. This is an inflexible deadline, and enterprises that are not ready risk outage. In...341pki,webpkifalse646fullhttps://www.spreaker.com/episode/root-causes-645-fapi-2-0-principles--7319435518a41217-5857-404a-99e1-ae5ddc035bf2Mon, 27 Jul 2026 14:53:34 +0000Tim CallanIn our series on digital identity for AI agents, we discuss FAPI 2.0 as an option.221ai (artificial intelligence),digital identitiesfalse645fullhttps://www.spreaker.com/episode/root-causes-644-cryptographically-bound-tokens--731475238a9dc6c0-bc3f-42a3-9719-bf5ddd13a313Fri, 24 Jul 2026 13:34:57 +0000Tim CallanIn our ongoing series on digital identity for agents, we have previous discussed use of certificates for authentication. In this episode we describe how cryptographic proof of possession can enable secure authentication using tokens.306ai (artificial intelligence),pkifalse644fullhttps://www.spreaker.com/episode/root-causes-643-certificates-for-stronger-agent-authentication--7310965559290db8-184a-4026-b26a-20db1419a25dWed, 22 Jul 2026 15:04:14 +0000Tim CallanWe survey different strategies for securely authenticating agentic AI, including certificates and SPIFFE. We discuss Zero Trust and the Principle of Least Privileges as applied to agents.650agentic ai,pkifalse643fullhttps://www.spreaker.com/episode/root-causes-642-anthropic-to-support-spiffe-spire--73068740fba7f071-2502-499b-966e-38b4866ff53eMon, 20 Jul 2026 13:28:02 +0000Tim CallanAnthropic has announced its intentions to support SPIFFE/SPIRE with the SPIRE server rooted in an "upstream authority," which will require a root private CA rather than allowing self-attestation for agentic AI.228false642fullhttps://www.spreaker.com/episode/root-causes-641-what-is-spire--730282591e523c8d-acf6-4598-a1f4-0471e4f829dbFri, 17 Jul 2026 14:15:08 +0000Tim CallanIn our episode 640 we defined SPIFFE, which provides digital identity for agentic workloads. In this episode we explain SPIRE (SPIFFE Runtime Environment), the SPIFFE certificate provisioning protocol.351ai (artificial intelligence),pki,spiffe,spirefalse641fullhttps://www.spreaker.com/episode/root-causes-640-what-is-spiffe--72991748e5a41378-8a1f-48d6-8aa1-6f19631593e9Wed, 15 Jul 2026 13:53:08 +0000Tim CallanSPIFFE (Secure Production Identity Framework for Everyone) is a standard for digital identity for agentic workloads. In this episode we explain.282pkifalse640fullhttps://www.spreaker.com/episode/root-causes-639-fighting-static-api-key-spillage-is-like-fighting-gravity--72914887b2ac46fa-2ce8-46d1-9874-7d93276ad6e4Fri, 10 Jul 2026 13:23:20 +0000Tim CallanStatic API keys are a common security practice. In this episode we discuss the risk of these keys being revealed, including directly by the AIs that use them.509ai,pkifalse639fullhttps://www.spreaker.com/episode/root-causes-638-catfishing--728711909acc608e-ed16-4576-a28c-f84a41e587e2Wed, 08 Jul 2026 14:36:26 +0000Tim CallanTim shares his very personal experience with would-be catfishers and we talk about how AI is set to change the catfishing attack.1276pki,securityfalse638fullhttps://www.spreaker.com/episode/root-causes-637-is-it-time-to-get-rid-of-ev-ssl--7284044918bb94ab-ab58-414d-ac3d-222816ada802Mon, 06 Jul 2026 14:10:19 +0000Tim CallanThe Baseline Requirements, CT logs, the Bugzilla Bloodbath, shortening certificate lifespans, all these trends serve to enforce a high level of quality and predictability across WebPKI certificates. Nearly twenty years after the introduction of EV...660pki,webpkifalse637fullhttps://www.spreaker.com/episode/root-causes-636-the-future-of-crypto-agility--72791451713aff01-f230-4329-bdfc-e23e80d180b0Thu, 02 Jul 2026 14:25:10 +0000Tim CallanDustin Moody of NIST joins us to talk about the evolution of standardized cryptography beyond the current PQC efforts. Topics include maintaining visibility on cryptography presently in use, 50 years of RSA, and cryptographic heterogeny.570cryptography,post quantum cryptography (pqcfalse636fullhttps://www.spreaker.com/episode/root-causes-635-do-we-need-to-get-rid-of-ecc--72744239354cffc1-f530-4cff-ba60-d68b9535a13eMon, 29 Jun 2026 16:13:49 +0000Tim CallanBas Westerbaan of Cloudflare joins us to discuss recent information that heightens concerns about Elliptic Curve Cryptography (ECC) and its vulnerability to a cryptographically relevant quantum computer (CRQC). We pose the question do we need to...574elliptic curve cryptography (e,post quantum cryptography (pqc,webpkifalse635fullhttps://www.spreaker.com/episode/root-causes-634-white-house-executive-order-accelerates-pqc-deployment--72704697768b42ac-6d72-4d66-96db-d928b1f61103Fri, 26 Jun 2026 16:07:20 +0000Tim CallanA new Executive Order (EO) moves the deadline for ML-DSA deployment up to 2031. We talk about why this happened and its implications on government, the technology industry, and enterprises around the globe.763pki,post quantum cryptography (pqcfalse634fullhttps://www.spreaker.com/episode/root-causes-633-etsi-pqc-conference-wrap-up--72671952c444087a-2810-4e05-a752-bbe332fa4129Wed, 24 Jun 2026 13:36:06 +0000Tim CallanWe are freshly returned from the 2026 ETSI PQC Conference. We give a debrief on the conference, including the difference between post quantum cryptography (PQC) and quantum key distribution (QKD), the algorithmic zoo, PQC for blockchain, the Dunning...972post quantum cryptography (pqc,quantum key distributionfalse633fullhttps://www.spreaker.com/episode/root-causes-632-gartner-risk-and-security-2026-wrapup--72635852fd25cc79-48f8-4573-a59b-936dfdd923c5Mon, 22 Jun 2026 15:51:46 +0000Tim CallanWe recently attended the Gartner Risk and Security conference for 2026, where we observed a great deal of attention on not only AI but also post quantum cryptography (PQC). Join us as we share the key takeaways.1196ai,pqcfalse632fullhttps://www.spreaker.com/episode/root-causes-631-did-the-bugzilla-bloodbath-change-anything--7260351330104afe-eaa0-4b17-9af5-99eb6376d2afFri, 19 Jun 2026 17:47:43 +0000Tim Callan2024 saw a flurry of high profile incidents for public CA, which we named the Bugzilla Bloodbath. We look back to see how the WebPKI has changed as a consequence.790webpkifalse631fullhttps://www.spreaker.com/episode/root-causes-630-the-pqc-physicality-crisis--725664704959ecde-0bda-4f82-a28a-70135e16752dWed, 17 Jun 2026 17:31:58 +0000Tim CallanResource-constrained devices may need to address PQC through real-time, seed-based, key generation. Unfortunately, this leaves the full key exposed very briefly in RAM. The potential consequences of this are far-reaching and scary. We go into the details.388post quantum cryptography (pqcfalse630fullhttps://www.spreaker.com/episode/root-causes-629-does-the-evidence-support-moving-pqc-deadlines-to-2029--725390253c0e7b83-4ce7-4c33-9e2a-65741999ca22Mon, 15 Jun 2026 17:48:40 +0000Tim CallanSam Jaques of the University of Waterloo returns to discuss his tracking of progress in quantum computers and offer a perspective on moving our PQC deadlines up to 2029.973post quantum cryptography (pqcfalse629fullhttps://www.spreaker.com/episode/root-causes-628-pi-dos-prompt-injection-based-denial-of-service--72498766e76e8f25-0809-4528-9a89-ad188cd92545Fri, 12 Jun 2026 13:29:12 +0000Tim CallanAn emerging attack against AIs is to create a significantly complex and recursive prompt that will occupy the AI indefinitely or for a sufficiently long time that it acts as a Denial-of-Service (DoS) attack. We describe how this works.581ai (artificial intelligence)false628fullhttps://www.spreaker.com/episode/root-causes-627-uk-vs-apple-e2ee-backups--7246511393710f87-229d-4a90-abed-e32ca39a4c65Wed, 10 Jun 2026 19:20:59 +0000Tim CallanIn the latest in our coverage of government versus encryption, the UK issued secret orders to Apple to give it a cryptographic backdoor to Apple's advanced data protection capability for iCloud. Apple responded by eliminating encryption entirely for...312government vs encryptionfalse627fullhttps://www.spreaker.com/episode/root-causes-626-tls-1-3-roadblock--72418799f85dccda-7145-4dba-931c-2cdbb334446cMon, 08 Jun 2026 13:55:46 +0000Tim CallanTLS 1.3 is required to take advantage of post quantum cryptography (PQC) algorithms. Yes, we still see a lot of TLS 1.2 or earlier in deployment. We examine why this is the case and what to do about it.616post quantum cryptography (pqc,ssl / tlsfalse626fullhttps://www.spreaker.com/episode/root-causes-625-ai-in-1000-days-cyber-defense--723674431331b4a2-1540-42c6-9b03-3835c6b3b2efFri, 05 Jun 2026 12:42:06 +0000Tim CallanRecent revelations about Mythos and its ability to expose vulnerabilities have forced us to rethink basic assumptions about cyber defense. In our "AI in 1000 Days" series, Jason Soroko and I examine the implications of these revelations three years...487ai (artificial intelligence),cybersecurity,pkifalse625fullhttps://www.spreaker.com/episode/root-causes-624-implications-of-mythos--72321282538b2cc2-9a55-47d1-8c6f-b7b24f86733cWed, 03 Jun 2026 12:28:30 +0000Tim CallanAnthropic has delayed its widespread release of Mythos to give major software providers a chance to close off the many vulnerabilities it has discovered. We dig into the vast implications of Mythos and other AI models for the future of cybersecurity.958cybersecurityfalse624fullhttps://www.spreaker.com/episode/root-causes-623-are-pqc-key-sized-big-enough--72278676e6366d7d-15a9-49c2-91d6-cbb756686c22Mon, 01 Jun 2026 13:30:55 +0000Tim CallanWe discuss the possibility that our standardized ML-DSA keys turn out to be too short for true confidence, why that might occur, and the implications for private PKI certificates.506pki,post quantum cryptography (pqcfalse623fullhttps://www.spreaker.com/episode/root-causes-622-modeling-the-time-to-crqc--722262335dcdfe67-dbf2-47bf-b49c-2607a7bbf095Fri, 29 May 2026 13:50:01 +0000Tim CallanSam Jaques joins us to explain his much-referenced chart mapping progress toward cryptographically relevant quantum computing (CRQC).932pki,post quantum cryptography (pqc,pqrcfalse622fullhttps://www.spreaker.com/episode/root-causes-621-simplicity-at-scale--7217153064875f38-7b5f-4388-be4e-ff3a89f2b104Tue, 26 May 2026 15:44:18 +0000Tim CallanWe break down the phrase "Simplicity at Scale" to see what it means to us in the context of CAs and CLM.312clm,pkifalse621fullhttps://www.spreaker.com/episode/root-causes-620-will-nist-update-its-pqc-timelines--72118909d9be8c81-94d0-425c-9288-6a81979418d5Fri, 22 May 2026 18:06:14 +0000Tim CallanA few years ago NIST proposed deadlines for PQC deployment at 2030 and 2035. But recent announcements from Google and Cloudflare suggest 2029 as a better deprecation target. We are joined by Dustin Moody to get the NIST perspective on these...568post quantum cryptography (pqcfalse620fullhttps://www.spreaker.com/episode/root-causes-619-do-we-all-need-to-adopt-pqc-by-2029--72055469cb0c3e22-a623-4145-a06f-1f3fc8274292Mon, 18 May 2026 12:59:11 +0000Tim CallanRecent announcements from Google and Cloudflare have declared new 2029 deadlines for full post quantum cryptography (PQC) migration. Bas Westerbaan explains the rationale behind Cloudflare's decision and discusses implications for other enterprises,...1023post quantum cryptography (pqc,ssl / tlsfalse619fullhttps://www.spreaker.com/episode/root-causes-618-mtc-and-private-pki--72023798aa301fb1-708e-4065-938a-04c8cce3d621Fri, 15 May 2026 17:43:48 +0000Tim CallanRepeat guest Bas Westerbaan of Cloudflare joins us to explore the role of Merkle Tree Certificates in private CA scenarios with an eye toward where they will be needed and where traditional PKI will be better suited.974merkle tree certificates (mtc),post quantum cryptography (pqcfalse618fullhttps://www.spreaker.com/episode/root-causes-617-what-are-x9-certificates--71991316b1fe59e4-2283-43d7-8151-ba991df33374Wed, 13 May 2026 14:29:16 +0000Tim CallanThe US-based X9 financial industry consortium has created a server certificate. We explain what X9 certificates are and suitable use cases for this certificate type.1293x9 certificatesfalse617fullhttps://www.spreaker.com/episode/root-causes-616-nist-and-merkle-tree-certificates--71956076cf91a97a-f03f-4c86-84ff-2c462b4f9ba8Mon, 11 May 2026 12:04:15 +0000Tim CallanDustin Moody of NIST joins us to discuss Merkle Tree Certificates (MTC) and the NIST position on them.412merkle tree certificates (mtc),post quantum cryptography (pqc,ssl / tlsfalse616fullhttps://www.spreaker.com/episode/root-causes-615-what-is-ietf-plants--71922770c7cc4c4b-1fa5-4af6-b5f9-9c39fe4b9488Fri, 08 May 2026 12:39:54 +0000Tim CallanRepeat guest Bas Westerbaan of Cloudflare joins us to explain the PLANTS working group in IETF, which is driving standards around post quantum cryptography (PQC) and Merkle Tree Certificates (MTC). Bas explains the path to becoming a final standard,...395merkle tree certificates (mtc),post quantum cryptography (pqc,ssl / tlsfalse615fullhttps://www.spreaker.com/episode/root-causes-614-mtc-and-downgrade-attacks--7188945314e542c3-ecce-4894-8c69-e57a4cd71490Wed, 06 May 2026 12:09:30 +0000Tim CallanIt's reasonable to believe that Merkle Tree Certificates (MTC) and traditional RSA will co-exist on the same servers for years, if not decades, during the transition to post quantum cryptography (PQC). Bas Westerbaan of Cloudflare joins us in this...733false614fullhttps://www.spreaker.com/episode/root-causes-613-status-of-the-nist-pqc-contests--71856049d5af36fa-7db0-4a6a-8ba9-0709d1ff26eaMon, 04 May 2026 13:28:42 +0000Tim CallanWe are joined by Dustin Moody of NIST to go over the current state of the various post quantum cryptography (PQC) contests, including upcoming FIPS standards for Falcon (FN-DSA) and HQC, other Round 4 algorithms, the digital signing algorithm (DSA) On...1355merkle tree certificates (mtc),post quantum cryptography (pqc,ssl / tlsfalse613fullhttps://www.spreaker.com/episode/root-causes-612-what-do-subscribers-need-for-mtc--71814655f1e6eacf-d762-4ee8-bcdd-44e58b0a152eFri, 01 May 2026 13:45:24 +0000Tim CallanWe are joined by Bas Westerbaan of Cloudflare to explain considerations and requirements for use of Merkle Tree Certificates (MTC). This includes full adoption of TLS 1.3, offering PQC and RSA at the same time, the imperative value of automation, and...764merkle tree certificates (mtc),post quantum cryptography (pqc,ssl / tlsfalse612fullhttps://www.spreaker.com/episode/root-causes-611-merkle-tree-certificates-what-and-why--7173345605207a23-8f97-4490-965b-48c954421b29Wed, 29 Apr 2026 14:04:08 +0000Tim CallanThere are strong reasons to believe that the architecture of PQC TLS will take the form of Merkle Tree Certificates (MTC). We are joined by post quantum cryptography expert Bas Westerbaan of Cloudflare as he explains this new PKI architecture, how it...1418merkle tree certificates (mtc),post quantum cryptography (pqcfalse611fullhttps://www.spreaker.com/episode/root-causes-610-types-of-logical-qubits--71671992871cfe48-3379-4eef-ae44-3e082e7df4b3Mon, 27 Apr 2026 12:53:21 +0000Tim CallanWe describe three different kinds of logical qubits with their relative strengths and weaknesses.602pki,post quantum cryptography (pqcfalse610fullhttps://www.spreaker.com/episode/root-causes-609-side-channel-apocalypse--71617069333cf350-3a9f-4370-a982-7b9b96b00348Fri, 24 Apr 2026 17:05:07 +0000Tim CallanJason explains the extreme danger of side channel attacks in the new post quantum cryptography (PQC) era.410pki,post quantum cryptography (pqcfalse609fullhttps://www.spreaker.com/episode/root-causes-608-the-fragility-of-formal-verification--71560981fff123b7-2b5b-4392-a4ba-f8d3655a37b9Wed, 22 Apr 2026 14:21:22 +0000Tim CallanThe reliability of cryptographic algorithms is largely a matter of conjecture based on track record. Proving security is impaired by the difficulty of formal verification, implementation weaknesses, and failure in randomness.472pki,post quantum cryptography (pqcfalse608fullhttps://www.spreaker.com/episode/root-causes-607-pki-that-s-hard-to-discover--71492598d763c100-eb37-4703-8e08-fd78750a7ecbMon, 20 Apr 2026 13:23:30 +0000Tim CallanThe first of the five pillars of Certificate Lifecycle Management (CLM) is discovery. While many of your certificates are easily discoverable, some difficult PKI remains.480certificate lifecycle manageme,clm,pkifalse607fullhttps://www.spreaker.com/episode/root-causes-606-what-is-the-uk-online-safety-act--714110248af7c208-751c-4d47-8424-fc1b618fe840Fri, 17 Apr 2026 15:16:16 +0000Tim CallanThe UK Online Safety Act intends to force vendors who sell hardware and software to allow the government to scan end-to-end encrypted communication on end devices. We once again marvel at governments seeking to undermine the security of their own...371encryption,pki,securityfalse606fullhttps://www.spreaker.com/episode/root-causes-605-chrome-declares-its-support-for-merkle-tree-certificates-mtc--7134443619e43b6c-effb-4576-9911-58620268a666Wed, 15 Apr 2026 13:54:43 +0000Tim CallanGoogle has taken a strong position supporting Merkle Tree Certificates (MTC) as the PQC-enabled future for SSL / TLS. We unpack this extremely important position from the WebPKI's most influential organization.558merkle tree certificates (mtc),post quantum cryptography (pqc,ssl / tlsfalse605fullhttps://www.spreaker.com/episode/root-causes-604-accelerated-timeline-for-quantum-computers-breaking-ecc-in-crypto-and-blockchain--71292335d1a0f6e6-2acd-483a-bd99-776d3e58cdedMon, 13 Apr 2026 14:56:56 +0000Tim CallanA new paper from Google Quantum AI and others documents a new technique for breaking ECC, particularly the curve protecting crypto currencies, smart contracts, and blockchain. This accelerates post quantum cryptography (PQC) timelines.670blockchain,post quantum cryptography (pqcfalse604fullhttps://www.spreaker.com/episode/root-causes-603-cryptographically-relevant-quantum-computing-crqc-with-only-10-000-qubits--712389509593d1f8-dba2-4a6a-8f9d-930fefd5118dFri, 10 Apr 2026 19:09:26 +0000Tim CallanNew research suggests that a cryptographically relevant quantum computer is achievable with only 10,000 qubits. This was an important contributor to Google moving its PQC target to 2029.567crqc,cryptography,pki,post quantum cryptography (pqcfalse603fullhttps://www.spreaker.com/episode/root-causes-602-google-moves-the-pqc-date-forward-to-2029--711879365e22447c-2490-45df-bda4-828b6c4a3fb9Wed, 08 Apr 2026 15:21:06 +0000Tim CallanGoogle has announced that it is moving its target for full PQC support to 2029. This is a strong statement from one of the most knowledgeable PQC technology companies that the existing 2030 target is too late.780cryptography,pki,post quantum cryptography (pqcfalse602fullhttps://www.spreaker.com/episode/root-causes-601-the-zombie-in-the-server-room--711331005d702f2f-375c-4f5d-a8bd-876bc2607f8bMon, 06 Apr 2026 13:22:08 +0000Tim CallanLegacy PKI implementations in the enterprise are holding back technical progress and creating security risk. We discuss reasons why, consequences, and what to do about it.411pkifalse601fullhttps://www.spreaker.com/episode/root-causes-600-cryptographic-design-is-not-neutral--71082316b2264648-a5d2-48ef-a438-be700a32b123Fri, 03 Apr 2026 12:11:41 +0000Tim CallanIn our previous episode we defined cryptography as the new geopolitics. Now in our 600th episode we follow up to explain how all cryptographic decisions reflect the social, political, and legal viewpoints of the cryptography's designers.620cryptography,pkifalse600fullhttps://www.spreaker.com/episode/root-causes-599-cryptography-is-the-new-geopolitics--7104441723f7d75b-929c-4323-992f-bf5b09d6185fWed, 01 Apr 2026 13:44:18 +0000Tim CallanIn the last decade or so, nations around the world have become keenly determined to use cryptography for their own legal, economic, and military advantage. We explore this concept.640cryptography,pkifalse599fullhttps://www.spreaker.com/episode/root-causes-598-why-johnny-can-t-authn-in-ot--71003642950b1ea3-ded0-4bc7-a2d5-3b9af3f132ffMon, 30 Mar 2026 17:25:50 +0000Tim CallanA recent CISA report declares that the nation's OT infrastructure is incapable of keeping up with the crypto agility and certificate management needs that modern security demands. We examine this finding.476pki,securityfalse598fullhttps://www.spreaker.com/episode/root-causes-597-if-you-don-t-hold-the-keys-you-don-t-hold-the-subpoenas--70928064b06362c5-f1d5-46f2-87f0-13ebda5dd3efFri, 27 Mar 2026 14:47:05 +0000Tim CallanMicrosoft has publicly stated that it will hand over Bitlocker keys to US law enforcement agencies without requiring a subpoena or court order. These keys can be held by users rather than Microsoft, at their option. We dive into this topic.447encryption,pkifalse597fullhttps://www.spreaker.com/episode/root-causes-596-clm-and-operational-uptime--708726275495476b-4373-4b34-9b55-b44c247b969cWed, 25 Mar 2026 13:21:18 +0000Tim CallanWe usually think of Certificate Lifecycle Management (CLM) as a security category. But we could equally well categorize it as an operations category that enables uptime. In this episode we make our case.404certificate lifecycle manageme,clmfalse596fullhttps://www.spreaker.com/episode/root-causes-595-what-is-a-digital-parasite--708299937d447100-dade-45d2-83f2-c269f12a6d6dMon, 23 Mar 2026 13:42:55 +0000Tim CallanWe introduce the concept of a "digital parasite," explaining why this attack philosophy appears to be on the rise.751pki,ransomware,securityfalse595fullhttps://www.spreaker.com/episode/root-causes-594-google-s-five-pqc-recommendations-for-policy-makers--707256136101dcb8-b004-45bc-8414-c46c22f2a4aeWed, 18 Mar 2026 21:04:04 +0000Tim CallanIn a recent blog post Google made five recommendations for policy makers. We walk down the list.1018pki,post quantum cryptography (pqcfalse594fullhttps://www.spreaker.com/episode/root-causes-592-when-a-caa-record-outlives-the-ca--706196638d58fda5-6e60-4f82-afc7-60a078a4b2abFri, 13 Mar 2026 08:20:00 +0000Tim CallanCAA records exist to restrict issuing CAs for a given domain to as few as one CA. But what happens when the CAA record outlives the CA to which it restricts issuance? Join us to find out.525false592fullhttps://www.spreaker.com/episode/root-causes-593-new-pqc-guidance-from-cisa--70648618155af289-cf61-4459-85b8-0f910a201726Wed, 11 Mar 2026 09:00:00 +0000Tim Callan1018false593fullhttps://www.spreaker.com/episode/root-causes-591-client-authentication-deprecation-date-moves-out--705903338d9586e7-7e6e-4cd8-979d-6d6923e3e79bWed, 11 Mar 2026 00:00:00 +0000Tim Callan707false591fullhttps://www.spreaker.com/episode/root-causes-590-the-size-of-the-ca-is-not-the-size-of-the-risk--70559028f061afd8-82ba-464a-9c5a-51d8e42dfaceTue, 10 Mar 2026 01:05:31 +0000Tim CallanIt would be easy to believe that the amount of risk posed to the WebPKI by any individual public CA is somehow proportional to the number of active certificates that CA has. This is false, however. In this episode we address this misconception.440digital certificates,pki,webpkifalse590fullhttps://www.spreaker.com/episode/root-causes-589-is-a-cryptographically-relevant-quantum-computer-economically-viable--70509798cbc77048-8288-4f54-9cdc-9335755a1506Fri, 06 Mar 2026 16:45:05 +0000Tim CallanWe recently heard the argument that it's simply too expensive to develop a cryptographically relevant quantum computer. We vehemently disagree. In this episode we explain why.576pki,post quantum cryptography (pqcfalse589fullhttps://www.spreaker.com/episode/root-causes-588-it-s-cryptographic-frogger-from-here-on-out--704473633dc4b1a2-4497-4b0b-9d8c-9d60ac1b3a61Wed, 04 Mar 2026 17:49:13 +0000Tim CallanIn this episode Tim explains that the transition to PQC is not just a change in cryptographic algorithms but also a fundamental shift in how we treat our cryptography. From here on out, IT systems need to be fundamentally crypto agile in a way we've...596cryptography,post quantum cryptography (pqcfalse588fullhttps://www.spreaker.com/episode/root-causes-587-ai-orchestration-for-attackers--7039303819149935-822e-4ae4-89ad-c03712b9640bMon, 02 Mar 2026 17:47:58 +0000Tim CallanJason describes a recent intrusion almost entirely operated by off-the-shelf AI tools. This is an important milestone in security. We describe its potential consequences.656aifalse587fullhttps://www.spreaker.com/episode/root-causes-586-beyond-harvest-now-decrypt-later--70329970fe886c96-068e-47f4-85d4-18086b85fd81Fri, 27 Feb 2026 00:00:00 +0000Tim CallanWe expand on the concept of trust-now-forge-later to list a whole bevy of additional attacks that eventually will be enabled by cryptographically relevant quantum computers.520pki,post quantum cryptography (pqc,securityfalse586fullhttps://www.spreaker.com/episode/root-causes-585-the-cryptographic-inventory-manifesto--70329974ddafde8b-ad4b-42ae-9245-28c2fcc37993Wed, 25 Feb 2026 00:00:00 +0000Tim CallanWe all love a good manifesto! Jason spells out the ten principles of the Cryptographic Inventory Manifesto, and we discuss.535cryptographic inventory,cryptography,cybersecurity,digital certificates,pqcfalse585fullhttps://www.spreaker.com/episode/root-causes-585-the-cryptographic-inventory-manifesto--70271715tag:soundcloud,2010:tracks/2273198534Tue, 24 Feb 2026 00:00:00 +0000Tim CallanWe all love a good manifesto! Jason spells out the ten principles of the Cryptographic Inventory Manifesto, and we discuss.535falsefullhttps://www.spreaker.com/episode/root-causes-584-mapping-dora-to-clm--70329968b2b5c67f-8c87-422c-859e-11733e3b3b83Mon, 23 Feb 2026 00:00:00 +0000Tim CallanWe look at the new European DORA and NIS2 regulations and how Certificate Lifecycle Management is a key requirement to meet these requirements. You will be surprised how explicit these requirements are.1239certificate lifecycle manageme,certificate lifespans,dora,european standard,pkifalse584fullhttps://www.spreaker.com/episode/root-causes-584-mapping-dora-to-clm--70237160tag:soundcloud,2010:tracks/2272069802Mon, 23 Feb 2026 00:00:00 +0000Tim CallanWe look at the new European DORA and NIS2 regulations and how Certificate Lifecycle Management is a key requirement to meet these requirements. You will be surprised how explicit these requirements are.1239falsefullhttps://www.spreaker.com/episode/root-causes-583-ai-versus-ecc-p-256--70185749tag:soundcloud,2010:tracks/2270589410Sat, 21 Feb 2026 00:00:00 +0000Tim CallanIn an innovative application, an AI has been used to find private keys for ECC (Elliptic Curve Cryptography) P 256. We explain how.652falsefullhttps://www.spreaker.com/episode/root-causes-583-ai-versus-ecc-p-256--703299913108d037-52b8-488a-9bd3-bf1c3c79e2e9Fri, 20 Feb 2026 00:00:00 +0000Tim CallanRecorded in Ottawa Ontario.652false583fullhttps://www.spreaker.com/episode/root-causes-582-new-research-drastically-cuts-number-of-qubits-for-cryptographic-relevance--70134740tag:soundcloud,2010:tracks/2268884726Tue, 17 Feb 2026 00:00:00 +0000Tim CallanNew research indicates that the number of qubits necessary to achieve cryptographic relevance has reduced by two orders of magnitude. We cover this breaking news and its implications.852falsefullhttps://www.spreaker.com/episode/root-causes-581-a-timeline-for-deprecation-of-manual-dcv-methods--70084135tag:soundcloud,2010:tracks/2267697077Sun, 15 Feb 2026 00:00:00 +0000Tim CallanBy CABF ballot all manual methods of Domain Control Validation (DCV) will be deprecated by 2028. We explain which methods are due for deprecation and when.790falsefullhttps://www.spreaker.com/episode/root-causes-580-top-use-cases-for-hybrid-certificates--70047880tag:soundcloud,2010:tracks/2266121072Fri, 13 Feb 2026 20:01:25 +0000Tim CallanWe go over the qualities in abstract of a use case that strongly invites the use of hybrid certificates and then run down a list of specific use cases that meet these criteria. This includes OT systems, code signing, secure boot, WiFi, enterprise...768falsefullhttps://www.spreaker.com/episode/root-causes-579-make-cryptography-boring-again--69975138tag:soundcloud,2010:tracks/2264552567Tue, 10 Feb 2026 00:00:00 +0000Tim CallanIn this episode Jason declares that we must make cryptography boring again. We get into what that means and why it matters.1065falsefullhttps://www.spreaker.com/episode/root-causes-578-200-days-won-t-actually-be-200-days--69892400tag:soundcloud,2010:tracks/2263198439Mon, 09 Feb 2026 00:00:00 +0000Tim CallanWe have seen much talk of the upcoming drop of maximum TLS term to 200 days, followed by 100 days, and eventually down to 47 days. It happens that all those numbers are too large and the actual maxima will be less than that. We explain.611falsefullhttps://www.spreaker.com/episode/root-causes-577-all-the-stuff-that-s-coming-in-march--69850440tag:soundcloud,2010:tracks/2261621081Fri, 06 Feb 2026 00:00:00 +0000Tim CallanMarch 2026 is due to be the most eventful month in the history of the WebPKI. Join us as we go over all the many changes coming next month.606falsefullhttps://www.spreaker.com/episode/root-causes-576-jeffries-dumps-bitcoin-due-to-the-quantum-threat--69791987tag:soundcloud,2010:tracks/2260204532Wed, 04 Feb 2026 00:00:00 +0000Tim CallanA large investment firm divests from Bitcoin for fear of the quantum threat.412falsefullhttps://www.spreaker.com/episode/root-causes-575-shortening-certificate-term-all-the-dates--69748306tag:soundcloud,2010:tracks/2259001127Mon, 02 Feb 2026 00:00:00 +0000Tim CallanEverybody knows about March 15 and the drop in maximum public TLS certificate term to 200 days. But that only scratches the surface on key dates with this maximum term reduction. Join us as we go over "all the dates" for TLS maximum term reduction.1250falsefullhttps://www.spreaker.com/episode/root-causes-574-2025-predictions-scorecard-part-2--69690740tag:soundcloud,2010:tracks/2257211948Fri, 30 Jan 2026 00:00:00 +0000Tim CallanWe score our 2025 predictions in this second of two parts.1174falsefullhttps://www.spreaker.com/episode/root-causes-573-2025-predictions-scorecard-part-1--69646075tag:soundcloud,2010:tracks/2255730848Wed, 28 Jan 2026 00:00:00 +0000Tim CallanEvery new year we make predictions for the year to come, and every year we go back and see how we did. This is the first of two parts scoring our 2025 predictions.1400falsefullhttps://www.spreaker.com/episode/root-causes-572-quality-of-entropy--69591364tag:soundcloud,2010:tracks/2254388483Mon, 26 Jan 2026 00:00:00 +0000Tim CallanWe discuss the idea that not all cryptographic entropy is equally "random" and potential consequences.525falsefullhttps://www.spreaker.com/episode/root-causes-571-will-there-ever-be-a-cryptographically-relevant-quantum-computer--69560062tag:soundcloud,2010:tracks/2252801873Fri, 23 Jan 2026 00:00:00 +0000Tim CallanWe discuss the idea that it might be impossible to actually create a cryptographically relevant quantum computer and weigh in on this idea.557falsefullhttps://www.spreaker.com/episode/root-causes-570-pqc-readiness-at-the-boardroom-level--69537385tag:soundcloud,2010:tracks/2251593371Wed, 21 Jan 2026 00:00:00 +0000Tim CallanRepeat guest Chris McGrath shares what enterprises need to be doing now to stay on track for the NIST PQC deadline in 2030.730falsefullhttps://www.spreaker.com/episode/root-causes-569-new-regulations-are-changing-the-pki-landscape--69510249tag:soundcloud,2010:tracks/2250415505Mon, 19 Jan 2026 00:00:00 +0000Tim CallanRepeat guest Chris McGrath joins us to discuss how increasingly strict regulations are requiring increased rigor, visibility, and auditability for enterprise digital certificates and PKI.599falsefullhttps://www.spreaker.com/episode/root-causes-568-upping-your-certificate-game-for-better-security--69469185tag:soundcloud,2010:tracks/2248686086Fri, 16 Jan 2026 00:00:00 +0000Tim CallanSenior cyber security advisor Chris McGrath joins us to discuss redefining digital certificates and their role in your organizational security profile, increasing regulation of certificates, and how enterprises can up their certificate game.756falsefullhttps://www.spreaker.com/episode/root-causes-567-top-10-pqc-laggards-in-the-enterprise--69437394tag:soundcloud,2010:tracks/2247308873Wed, 14 Jan 2026 00:00:00 +0000Tim CallanWe name the ten enterprise environments and use cases that are most likely to be late adopters of post quantum cryptography (PQC).1245falsefullhttps://www.spreaker.com/episode/root-causes-566-time-is-a-security-primitive--69406024tag:soundcloud,2010:tracks/2246257541Mon, 12 Jan 2026 00:00:00 +0000Tim CallanWe discuss the foundational importance of time in PKI and security in general. This includes when things happen, the order in which things happen, and attacks based on time-spoofing. We drill down on certificates, roots, timestamping, Certificate...739falsefullhttps://www.spreaker.com/episode/root-causes-565-our-response-to-qwac-arguments-part-3--69375257tag:soundcloud,2010:tracks/2244697532Fri, 09 Jan 2026 00:00:00 +0000Tim CallanIn our concluding episode on the topic, we scrutinize arguments make for and against QWACs, this time focused on "compliance and interoperability."697falsefullhttps://www.spreaker.com/episode/root-causes-564-our-response-to-qwac-arguments-part-2--69343775tag:soundcloud,2010:tracks/2243322119Wed, 07 Jan 2026 00:00:00 +0000Tim CallanIn our second of three episodes on the topic, we scrutinize arguments make for and against QWAKs, this time focused on "governance and sovereignty."682falsefullhttps://www.spreaker.com/episode/root-causes-563-our-response-to-qwac-arguments-part-1--69310826tag:soundcloud,2010:tracks/2242233683Mon, 05 Jan 2026 21:07:02 +0000Tim CallanAs a follow up to our episode 546, we break down the first of three sets of arguments about QWACs and examine their level of validity.959falsefullhttps://www.spreaker.com/episode/root-causes-562-what-is-a-side-oracle-attack--69251442tag:soundcloud,2010:tracks/2238955376Tue, 30 Dec 2025 00:00:00 +0000Tim CallanYou may have heard of side channel attacks. Now Jason explains what a side oracle attack is and how a side oracle attack in conjunction with AI could be effective against the HQC or Falcon PQC algorithms.478falsefullhttps://www.spreaker.com/episode/root-causes-561-what-is-classic-mceliece--69186001tag:soundcloud,2010:tracks/2235351191Tue, 23 Dec 2025 00:00:00 +0000Tim CallanOne of the NIST Round 3 PQC finalists that was never selected or eliminated is Classic McEliece. In this episode we explain in non-math terms how this algorithm works.475falsefullhttps://www.spreaker.com/episode/root-causes-560-ai-in-1000-days-small-language-models--69134599tag:soundcloud,2010:tracks/2232817193Thu, 18 Dec 2025 00:00:00 +0000Tim CallanContinuing our examination of AI in 1000 days, we discuss the use of finely tuned small language models for highly specific use cases.654falsefullhttps://www.spreaker.com/episode/root-causes-559-ai-1000-days-content-quality--69106212tag:soundcloud,2010:tracks/2231545859Wed, 17 Dec 2025 00:00:00 +0000Tim CallanWe discuss what happens when the quality gap between AI-generated and human-generated content drops to zero. We explore the consequences of this inevitable outcome.752falsefullhttps://www.spreaker.com/episode/root-causes-558-ai-in-1000-days-human-in-the-loop-economy--69060340tag:soundcloud,2010:tracks/2230142717Mon, 15 Dec 2025 00:00:00 +0000Tim CallanIn our ongoing series on what AI will look like in 1000 days, we discuss the spread of a new business process, where AIs do the bulk of the work while humans sit in the loop for certain specific tasks and roles.461falsefullhttps://www.spreaker.com/episode/root-causes-557-top-5-pqc-laggards--69029913tag:soundcloud,2010:tracks/2228664827Fri, 12 Dec 2025 00:00:00 +0000Tim CallanFollowing up on our list of top 5 PQC vanguards, in this episode we detail the top 5 PQC laggards.588falsefullhttps://www.spreaker.com/episode/root-causes-556-top-5-pqc-vanguards--68980112tag:soundcloud,2010:tracks/2227371797Wed, 10 Dec 2025 00:00:00 +0000Tim CallanWe describe the top five technology categories that are on the vanguard of driving PQC adoption. We describe what these categories have in common and how that results in early adoption of post quantum cryptography.599falsefullhttps://www.spreaker.com/episode/root-causes-555-perpretrators-of-rogue-certificates--68948474tag:soundcloud,2010:tracks/2226274679Mon, 08 Dec 2025 00:00:00 +0000Tim CallanWe detail the top ten groups inside the organization who introduce rogue certificates into IT organizations.763falsefullhttps://www.spreaker.com/episode/root-causes-554-disentangling-quantum--68901910tag:soundcloud,2010:tracks/2224617932Fri, 05 Dec 2025 00:00:00 +0000Tim CallanTech watchers tend to conflate the many quantum technologies under development right now. In this episode we go through these technologies and explain how they connect.615falsefullhttps://www.spreaker.com/episode/root-causes-553-connecting-quantum-clocks-to-cryptography--68870218tag:soundcloud,2010:tracks/2223613016Wed, 03 Dec 2025 00:00:00 +0000Tim CallanWe discuss quantum clocks and their potential role in cryptography.356falsefullhttps://www.spreaker.com/episode/root-causes-552-2026-predictions--68822371tag:soundcloud,2010:tracks/2222251814Mon, 01 Dec 2025 00:00:00 +0000Tim CallanWe share our PKI predictions for 2026. Topics include PQC, eIDAS 2, CT logging, ACME, passkeys, CA distrust, AI model poisoning, and new attack vectors.1964falsefullhttps://www.spreaker.com/episode/root-causes-551-pki-in-a-swarm-at-50-mph--68728913tag:soundcloud,2010:tracks/2218351724Mon, 24 Nov 2025 00:00:00 +0000Tim CallanJason explores the role cryptography and trust systems play in the command and control of groups of autonomous drone systems.594falsefullhttps://www.spreaker.com/episode/root-causes-550-webpki-certificate-lifespan-how-low-can-you-go--68685132tag:soundcloud,2010:tracks/2216773616Fri, 21 Nov 2025 00:00:00 +0000Tim CallanCertificate maximum term is shrinking. In this episode we examine exactly how short they could get.947falsefullhttps://www.spreaker.com/episode/root-causes-549-ai-1000-days-from-now-the-defeat-of-voice-authentication--68649667tag:soundcloud,2010:tracks/2215654094Wed, 19 Nov 2025 00:00:00 +0000Tim CallanIn our ongoing series on AI in 1000 days, we describe the inevitable, complete distrust of voice printing as an authentication method, including why and what we think will happen.1091falsefullhttps://www.spreaker.com/episode/root-causes-548-ai-1000-days-from-now-emotional-intelligence--68604566tag:soundcloud,2010:tracks/2214189182Mon, 17 Nov 2025 00:00:00 +0000Tim CallanWe begin a new series about what we expect from AI in the next three years. In this episode we discuss AI emulating emotional intelligence and its benefits.1064falsefullhttps://www.spreaker.com/episode/root-causes-547-should-we-do-mass-revocation-fire-drills--68571779tag:soundcloud,2010:tracks/2212651718Fri, 14 Nov 2025 18:19:07 +0000Tim CallanIn this episode we discuss the value for enterprises in running mass revocation drills and compare the merits of tabletop exercises versus voluntary revocation events.753falsefullhttps://www.spreaker.com/episode/root-causes-546-new-research-codifies-arguments-for-and-against-qwacs--68544027tag:soundcloud,2010:tracks/2211490553Wed, 12 Nov 2025 00:00:00 +0000Tim CallanWe are joined by guests Pol Holzmer and Johannes Sedlmeir to describe their recent research that documents and organizes public arguments made about QWAC certificates.2606falsefullhttps://www.spreaker.com/episode/root-causes-545-what-is-mosh--68498626tag:soundcloud,2010:tracks/2210138207Mon, 10 Nov 2025 00:00:00 +0000Tim CallanThe MOSH tool aids the use of SSH-secured sessions, especially across different systems. Jason unpacks the security of this system and how it uses encryption and shared secrets.499falsefullhttps://www.spreaker.com/episode/root-causes-54-what-is-chain-of-lure--68469039tag:soundcloud,2010:tracks/2208813338Fri, 07 Nov 2025 00:00:00 +0000Tim CallanChain of lure is an attack method used to circumvent restrictions and boundaries places on AIs. Jason explains this attack and its implications.603falsefullhttps://www.spreaker.com/episode/root-causes-543-ai-finds-a-zero-day--68442539tag:soundcloud,2010:tracks/2207500515Wed, 05 Nov 2025 00:00:00 +0000Tim CallanWe have seen the first known instance of an AI tool discovering a zero-day vulnerability. This could have vast implications on vulnerability detection and bug bounty programs. We discuss the implications.1066falsefullhttps://www.spreaker.com/episode/root-causes-542-use-cases-for-hqc--68403383tag:soundcloud,2010:tracks/2205649003Sun, 02 Nov 2025 00:00:00 +0000Tim CallanIn this episode we go over some of the reasons one might choose HQC over ML-KEM as a PQC key exchange algorithm for specific circumstances. And we discuss the future diversity of cryptography.635falsefullhttps://www.spreaker.com/episode/root-causes-541-introducing-the-hqc-pqc-algorithm--68378318tag:soundcloud,2010:tracks/2204032767Fri, 31 Oct 2025 00:00:00 +0000Tim CallanNIST recently selected a second Key Exchange Module (KEM) among the PQC algorithms, HQC. We explain this code-based algorithm.413falsefullhttps://www.spreaker.com/episode/root-causes-540-contextual-cbom--68297712tag:soundcloud,2010:tracks/2200012703Mon, 27 Oct 2025 00:00:00 +0000Tim CallanWe define Cryptographic Bill of Materials (CBOM), which is more than a list of your cryptography and where it is. A CBOM need also include information about the PQC readiness of environments, availability of updates, and the importance of secrets.664falsefullhttps://www.spreaker.com/episode/root-causes-539-what-is-the-two-qwac-architecture--68246259tag:soundcloud,2010:tracks/2196556887Wed, 22 Oct 2025 00:00:00 +0000Tim CallanA new kind of eIDAS QWAC (Qualifieid Website Authentication Certificate) is on the way. The "two-QWAC architecture" introduces a second certificate containing organization information to be displayed by the browser, to sit alongside but independent of...1203falsefullhttps://www.spreaker.com/episode/root-causes-538-what-is-an-entropy-desert--68215768tag:soundcloud,2010:tracks/2194581507Mon, 20 Oct 2025 00:00:00 +0000Tim CallanAn environment in which credentials are extremely predictable could be described as an entropy desert. There are occurring at a global scale. We discuss concepts like measurable entropy availability and entropy by design.543falsefullhttps://www.spreaker.com/episode/root-causes-537-the-thermodynamics-of-privacy--68175836tag:soundcloud,2010:tracks/2192281667Fri, 17 Oct 2025 00:00:00 +0000Tim CallanIn this episode we build on our concept of entropy-aware guidance to explain how we might quantify privacy. We touch on GDPR, proof of work, and Landaur's principle.815falsefullhttps://www.spreaker.com/episode/root-causes-536-patent-blocker-on-ml-kem--68151191tag:soundcloud,2010:tracks/2190819231Wed, 15 Oct 2025 00:00:00 +0000Tim CallanA patent dispute in 2024 nearly blocked ML-KEM. But emerging thinking raises concern that the 2024 resolution did not guarantee full, clear access to all ML-KEM implementations. We explain.712falsefullhttps://www.spreaker.com/episode/root-causes-535-the-cps-is-a-superset-of-actual-practices--68123907tag:soundcloud,2010:tracks/2189558243Sun, 12 Oct 2025 00:00:00 +0000Tim CallanThe CPS must always be a superset of actual practices in a properly running CA. We explain why this is a product of good design.623falsefullhttps://www.spreaker.com/episode/root-causes-534-signing-the-machines-that-think--68093405tag:soundcloud,2010:tracks/2187354483Fri, 10 Oct 2025 17:47:53 +0000Tim CallanImagine what happens if you use the wrong LLM, including a malicious model placed there to create mischief or crime. How do you know? Jason proposes that, the same way we sign our code, we should be signing our AI models as well.537falsefullhttps://www.spreaker.com/episode/root-causes-533-flexibility-through-multi-ca-trust-models--68048378tag:soundcloud,2010:tracks/2184313987Tue, 07 Oct 2025 14:37:29 +0000Tim CallanWe discuss how a static PKI structure can hurt corporate flexibility and resilience. Events like reorgs and M&A activity can cause intractable problems with the wrong PKI setup. Plus, Jason coins the term PKI archeology.566falsefullhttps://www.spreaker.com/episode/root-causes-532-introducing-offline-pki--68002444tag:soundcloud,2010:tracks/2181721771Thu, 02 Oct 2025 00:00:00 +0000Tim CallanIn this episode, Jason describes how we might use the principles of PKI in a purely offline scenario.665falsefullhttps://www.spreaker.com/episode/root-causes-531-benefits-of-single-purpose-root-hierarchies--67980801tag:soundcloud,2010:tracks/2180429579Wed, 01 Oct 2025 00:00:00 +0000Tim CallanPublic certificates are transitioning from multi-purpose root hierarchies to single-purpose ones. We discuss why.997falsefullhttps://www.spreaker.com/episode/root-causes-530-introducing-the-ai-iceberg--67943414tag:soundcloud,2010:tracks/2178716436Mon, 29 Sep 2025 00:00:00 +0000Tim CallanWe compare AI in 2025 to Internet in 1995 and describe the AI iceberg, including the majority of applications which are below the waterline.1127falsefullhttps://www.spreaker.com/episode/root-causes-529-what-is-a-common-mark-certificate--67880792tag:soundcloud,2010:tracks/2175984219Wed, 24 Sep 2025 18:30:27 +0000Tim CallanVerified Mark Certificates (VMC) now have a companion product for logos that are not registered trademarks, called a Common Mark Certificate (CMC). We explain the differences.453falsefullhttps://www.spreaker.com/episode/root-causes-528-misissued-ssl-certificate-for-1-1-1-1--67811052tag:soundcloud,2010:tracks/2172772287Wed, 17 Sep 2025 00:00:00 +0000Tim CallanA CA has incorrectly issued TLS certificates for the 1.1.1.1 and 2.2.2.2 IP addresses. We go into the details.1052falsefullhttps://www.spreaker.com/episode/root-causes-527-key-dates-for-the-deprecation-of-public-mtls--67768829tag:soundcloud,2010:tracks/2170977132Mon, 15 Sep 2025 00:00:00 +0000Tim CallanClient authentication using public TLS server certificates is on the deprecation path. In this episode we go through the key dates in this deprecation.626falsefullhttps://www.spreaker.com/episode/root-causes-526-voice-biometrics-are-worthless--67738886tag:soundcloud,2010:tracks/2169577398Fri, 12 Sep 2025 00:00:00 +0000Tim CallanBased on the ready availability of AI-based voice cloning, we declare voice biometric authentication to be utterly valueless.513falsefullhttps://www.spreaker.com/episode/root-causes-525-the-end-of-email-based-dcv--67707399tag:soundcloud,2010:tracks/2168322969Wed, 10 Sep 2025 00:00:00 +0000Tim CallanA new CABF ballot proposal will eliminate all email- and phone-based DCV over the next few years. We go into the details.604falsefullhttps://www.spreaker.com/episode/root-causes-524-how-to-kill-three-birds-with-one-stone--67675539tag:soundcloud,2010:tracks/2166952509Mon, 08 Sep 2025 00:00:00 +0000Tim CallanThree major changes are coming to the world of public certificates, all of which require major changes in how organizations deploy, renew, and manage their certificates. These are 47-day SSL, PQC, and the deprecation of mTLS. We describe the overlap...763falsefullhttps://www.spreaker.com/episode/root-causes-523-will-your-configuration-block-mpic-dcv--67622635tag:soundcloud,2010:tracks/2164194417Wed, 03 Sep 2025 00:00:00 +0000Tim CallanMPIC (Multi-perspective Issuance Corroboration) is soon to move into enforcement phase. In this episode we describe three configuration decisions that can force Domain Control Validation (DCV) to fail and tell you what to do about them before you have...677falsefullhttps://www.spreaker.com/episode/root-causes-522-how-prepared-are-enterprises-for-pqc-part-2--67545147tag:soundcloud,2010:tracks/2160975474Wed, 27 Aug 2025 00:00:00 +0000Tim CallanWe complete our description and commentary on the results of Sectigo's survey of enterprise preparedness for Post Quantum Cryptography (PQC).2009falsefullhttps://www.spreaker.com/episode/root-causes-521-how-prepared-are-enterprises-for-pqc-part-1--67482464tag:soundcloud,2010:tracks/2157705177Fri, 22 Aug 2025 00:00:00 +0000Tim CallanWe begin to go over the results of Sectigo's recent survey of enterprises and their preparedness and plans for adopting Post Quantum Cryptography (PQC).1943falsefullhttps://www.spreaker.com/episode/root-causes-520-how-prepared-are-it-teams-for-47-day-certificates--67457959tag:soundcloud,2010:tracks/2156463075Wed, 20 Aug 2025 00:00:00 +0000Tim CallanSectigo has released the results of its survey of IT professionals in charge of certificates to measure their readiness and preparation for 47-day maximum certificate term. We go over the results.2706falsefullhttps://www.spreaker.com/episode/root-causes-519-ai-is-the-room--67422988tag:soundcloud,2010:tracks/2155391607Mon, 18 Aug 2025 00:00:00 +0000Tim CallanAI is not the elephant in the room. It is the room itself. Jason explains what he means by that.1106falsefullhttps://www.spreaker.com/episode/root-causes-518-ncsc-lukewarm-on-fido-webauthn--67358245tag:soundcloud,2010:tracks/2152568520Wed, 13 Aug 2025 16:39:38 +0000Tim CallanBritain's National Cyber Security Centre recently issued a lukewarm verdict on passkeys as an authentication solution. We explore the problems with WebAuthn, including account recovery, spotty availability, inconsistent implementation, and lack of...992falsefullhttps://www.spreaker.com/episode/root-causes-517-the-cost-of-quantum-factoring--67116030tag:soundcloud,2010:tracks/2136524310Fri, 25 Jul 2025 00:00:00 +0000Tim CallanJason walks us through an important recent paper from Google tracking the cost of quantum factoring.321falsefullhttps://www.spreaker.com/episode/root-causes-516-pqc-for-adcs--67056897tag:soundcloud,2010:tracks/2133865932Mon, 21 Jul 2025 00:00:00 +0000Tim CallanMicrosoft has finally announced that it will offer an update to Active Directory Certificate Services (ADCS, formerly MSCA) to support post quantum cryptography. We discuss Microsoft's checkered support for ADCS and offer some questions users should...820falsefullhttps://www.spreaker.com/episode/root-causes-515-what-is-entropy-aware-governance--67029927tag:soundcloud,2010:tracks/2132474928Fri, 18 Jul 2025 00:00:00 +0000Tim CallanJason coins the term "entropy-aware governance" to describe the idea of using the degree of entropy it contains to measure the strength of any given secret. This could be an objective, consistent metric that could be applied to standard practices and...892falsefullhttps://www.spreaker.com/episode/root-causes-514-diary-of-an-online-firestorm--67000917tag:soundcloud,2010:tracks/2131171575Wed, 16 Jul 2025 00:00:00 +0000Tim CallanTim describes how the addition of an item to the CABF face-to-face meeting agenda blew up into a panicked and outraged online thread. We discuss what a more functional response would have looked like.766falsefullhttps://www.spreaker.com/episode/root-causes-513-is-revocation-the-best-remedy-for-cps-misalignment--66974491tag:soundcloud,2010:tracks/2129716587Mon, 14 Jul 2025 00:00:00 +0000Tim CallanWe continue our discussion of CPS misalignment by discussing the reasons for revocation as a remedy, its disadvantages, and the possibility of another solution that provides the same benefits at less cost.742falsefullhttps://www.spreaker.com/episode/root-causes-512-cps-versus-practices-misalignment--66944074tag:soundcloud,2010:tracks/2128329717Fri, 11 Jul 2025 00:00:00 +0000Tim CallanWe examine the circumstance where otherwise allowed practices are out of alignment with the stated practices in the relevant CPS. We discuss CA transparency and accountability, increased scrutiny of the CPS, and mass revocation.762falsefullhttps://www.spreaker.com/episode/root-causes-511-the-goml-root-store--66870524tag:soundcloud,2010:tracks/2125146465Sat, 05 Jul 2025 18:45:33 +0000Tim CallanWe follow up on our discussion of the Get off My Lawn (GoTM) browser with Jason's adventure in creating his own custom root store.942falsefullhttps://www.spreaker.com/episode/root-causes-510-introducing-the-goml-browser--66774118tag:soundcloud,2010:tracks/2120637906Thu, 26 Jun 2025 00:00:00 +0000Tim CallanWe discuss Jason's code vibing journey to create the Get Off My Lawn! (GoTM) browser. We discuss SSL certificate information, EV indicators, and cookie handling.618falsefullhttps://www.spreaker.com/episode/root-causes-509-what-is-a-cps--66745864tag:soundcloud,2010:tracks/2119335714Wed, 25 Jun 2025 00:00:00 +0000Tim CallanWe define CPS (Certificate Practices Statement) and explain the role it plays in both the WebPKI and private CAs.451falsefullhttps://www.spreaker.com/episode/root-causes-508-what-is-code-vibing--66711054tag:soundcloud,2010:tracks/2118306795Mon, 23 Jun 2025 18:49:44 +0000Tim Callan"Code vibing" is using generative AI to create or improve working code. We share Jason's adventure using code vibing to create his own web browser.1064falsefullhttps://www.spreaker.com/episode/root-causes-507-first-distrust-of-2025--66638784tag:soundcloud,2010:tracks/2116385109Thu, 19 Jun 2025 21:36:04 +0000Tim CallanThe first CA distrust event of 2025 comes with two simultaneous CA distrusts. We give you the details.573falsefullhttps://www.spreaker.com/episode/root-causes-506-recap-of-cabf-face-to-face-65--66592589tag:soundcloud,2010:tracks/2114941899Tue, 17 Jun 2025 15:18:35 +0000Tim CallanFor the first time ever, Jason and I record an episode from the floor of the CA/Browser Forum face-to-face meeting. We recap the themes of this meeting, and Jason gives his first impressions of a CABF Face-to-face.534falsefullhttps://www.spreaker.com/episode/root-causes-505-trust-now-forge-later--66549640tag:soundcloud,2010:tracks/2112786915Fri, 13 Jun 2025 00:00:00 +0000Tim CallanIn this episode we explain the potential for future quantum computers to break files signed today with RSA or ECC, called "Trust now, forge later."634falsefullhttps://www.spreaker.com/episode/root-causes-504-jason-programs-a-quantum-computer--66499654tag:soundcloud,2010:tracks/2111162898Tue, 10 Jun 2025 21:46:47 +0000Tim CallanJason describes his recent experience using Amazon Braket.1069falsefullhttps://www.spreaker.com/episode/root-causes-503-what-are-hybrid-and-composite-pqc--66423613tag:soundcloud,2010:tracks/2108972148Fri, 06 Jun 2025 00:00:00 +0000Tim CallanWe explain the difference between two strategies of PQC implementation, which we call hybrid and composite.484falsefullhttps://www.spreaker.com/episode/root-causes-502-the-pqc-game-of-chicken--66400993tag:soundcloud,2010:tracks/2107796214Wed, 04 Jun 2025 00:00:00 +0000Tim CallanIn this episode Jason explains the fallacy of "playing chicken" with the Quantum Apocalypse. We discuss stack ranking and "eyes open" PQC risk decisions.660falsefullhttps://www.spreaker.com/episode/root-causes-501-why-increasing-rsa-key-size-won-t-solve-the-quantum-problem--66370630tag:soundcloud,2010:tracks/2106502629Mon, 02 Jun 2025 00:00:00 +0000Tim CallanIn this brief episode we explain why the problem that Shor's Algorithm poses to RSA and ECC can't be solved simply by increasing key size.216falsefullhttps://www.spreaker.com/episode/root-causes-500-omg-500-episodes-of-root-causes--66340251tag:soundcloud,2010:tracks/2104868721Thu, 29 May 2025 00:00:00 +0000Tim CallanWow. It's episode 500 of Root Causes. Jason and Tim talk about how the podcast has evolved in the past six years, how it remains consistent, and the updates we're making to keep being a valuable resource for our listeners.1247falsefullhttps://www.spreaker.com/episode/root-causes-499-don-t-blame-signal--66294306tag:soundcloud,2010:tracks/2103122133Tue, 27 May 2025 14:21:21 +0000Tim CallanThe recent Signal controversy highlights the importance of understanding what protections an E2EE messaging app provides, and what it does not.518falsefullhttps://www.spreaker.com/episode/root-causes-498-uk-ncsc-pqc-guidance--66233547tag:soundcloud,2010:tracks/2101077546Fri, 23 May 2025 00:00:00 +0000Tim CallanThe UK National Cyber Security Centre (NCSC) has released new PQC guidance. We take exception to the dates it gives and explain why.932falsefullhttps://www.spreaker.com/episode/root-causes-497-pqc-update-with-sofia-celi--66192928tag:soundcloud,2010:tracks/2099864202Wed, 21 May 2025 00:00:00 +0000Tim CallanGuest Sofia Celi (IETF, Brave) returns to talk about important developments in post quantum cryptography. Sofia tells us about her candidate algorithm MAYO and what is happening with the NIST PQC onramp. We learn about KEM TLS and the status of PQC...1191falsefullhttps://www.spreaker.com/episode/root-causes-496-e2ee-gmail--66153718tag:soundcloud,2010:tracks/2098574670Sun, 18 May 2025 00:00:00 +0000Tim CallanGmail is now end-to-end encrypted for all recipients, regardless of the receiving client. We explain how Gmail accomplishes this trick.747falsefullhttps://www.spreaker.com/episode/root-causes-495-trust-models-and-post-quantum-cryptography--66122981tag:soundcloud,2010:tracks/2097060360Fri, 16 May 2025 00:00:00 +0000Tim CallanWe build on our Trust Models discussion to explore how organizations can structure their PKI for the transition to post quantum cryptography (PQC).421falsefullhttps://www.spreaker.com/episode/root-causes-494-introduction-to-trust-models--66076351tag:soundcloud,2010:tracks/2095150842Tue, 13 May 2025 00:00:00 +0000Tim CallanWe explain the basics of trust models and compare various models including WebPKI, private CA, and consortium models.1270falsefullhttps://www.spreaker.com/episode/root-causes-49-disentangling-public-and-private-certificate-use-cases--65996994tag:soundcloud,2010:tracks/2092120323Thu, 08 May 2025 00:00:00 +0000Tim CallanChanging root store requirements mean CAs must separate their root hierarchies for different certificate types. We explain why enterprises should consider private CA for some use cases.731falsefullhttps://www.spreaker.com/episode/root-causes-492-when-mandatory-security-training-sucks--65933459tag:soundcloud,2010:tracks/2090859687Tue, 06 May 2025 00:00:00 +0000Tim CallanIn this episode we get excited about errors we see in mandatory security trainings.1177falsefullhttps://www.spreaker.com/episode/root-causes-491-rsa-s-non-quantum-threat--65829712tag:soundcloud,2010:tracks/2088408507Thu, 01 May 2025 00:00:00 +0000Tim CallanWe are rejoined by Dr. Michele Mosca to explore the potential threat of RSA being broken even in the absence of a quantum computing attack.1902falsefullhttps://www.spreaker.com/episode/root-causes-490-chrome-and-chromium--65781597tag:soundcloud,2010:tracks/2086592802Mon, 28 Apr 2025 00:00:00 +0000Tim CallanWe define Chrome versus Chromium, explaining what each is and the difference between the two.603falsefullhttps://www.spreaker.com/episode/root-causes-489-does-ai-nullify-e2ee--65703197tag:soundcloud,2010:tracks/2084265159Thu, 24 Apr 2025 00:00:00 +0000Tim CallanDoes AI kill end-to-end encryption? There is a contention that the presence of AI agents in the workstream will render your confidential information visible outside the encrypted communication channels and therefore that E2EE is pointless. We...725falsefullhttps://www.spreaker.com/episode/root-causes-488-cabf-face-to-face-meeting-update--65668352tag:soundcloud,2010:tracks/2083237791Tue, 22 Apr 2025 00:00:00 +0000Tim CallanWe explain the major news items from the most recent CA/Browser Forum face-to-face meeting in Tokyo. Topics include MPIC, 47-day certificate term, and Temporary Restraining Orders.338falsefullhttps://www.spreaker.com/episode/root-causes-487-security-2030--65614773tag:soundcloud,2010:tracks/2080599090Wed, 16 Apr 2025 00:00:00 +0000Tim CallanJason and I take a peek forward at what we imagine IT security looks like in 2030. Topics include PQC, ZTNA, "green zones," deep fakes, IoT, connected cars, agentic AI, blockchain, and CLM.2801falsefullhttps://www.spreaker.com/episode/root-causes-486-47-day-maximum-term-ballot-passes-cabf--65569756tag:soundcloud,2010:tracks/2078508100Mon, 14 Apr 2025 00:00:00 +0000Tim CallanApple's ballot to step the maximum term for public SSL certificates down to 47 days has passed in the CA/Browser Forum. We explain.672falsefullhttps://www.spreaker.com/episode/root-causes-485-what-is-open-mpic--65554045tag:soundcloud,2010:tracks/2077377660Sun, 13 Apr 2025 00:00:00 +0000Tim CallanGuest Dmitry Sharkov joins us to describe Open MPIC, the open-source project to help public CAs support MPIC.1229falsefullhttps://www.spreaker.com/episode/root-causes-484-multi-good-factor-authentication--65485376tag:soundcloud,2010:tracks/2074742832Wed, 09 Apr 2025 00:00:00 +0000Tim CallanWe define multi good factor authentication, which is the idea that not all authentication factors are equal. We discuss the importance of considering authentication strength and the contextual nature of trust.767falsefullhttps://www.spreaker.com/episode/root-causes-483-introducing-the-pqc-sandbox--65410672tag:soundcloud,2010:tracks/2073183752Mon, 07 Apr 2025 00:00:00 +0000Tim CallanWe are joined by repeat guest Bruno Coulliard of Crypto4A to introduce Sectigo's new post quantum cryptography (PQC) sandbox. The PQC sandbox allows you to get quantum resistant certificates in your hands to understand how they work with your systems.1361falsefullhttps://www.spreaker.com/episode/root-causes-482-microsoft-and-pqc--65319041tag:soundcloud,2010:tracks/2069215320Wed, 02 Apr 2025 00:00:00 +0000Tim CallanIn this episode we explore the potential PQC future for Microsoft Active Directory Certificate Services, aka MSCA. We discuss potential paths for Microsoft to take and their consequences.879falsefullhttps://www.spreaker.com/episode/root-causes-481-what-is-protocol-ossification--65258232tag:soundcloud,2010:tracks/2067675776Mon, 31 Mar 2025 00:00:00 +0000Tim CallanProtocol ossification is the phenomenon whereby ecosystems fail to work correctly with the full range of options included in a protocol. This occurs when individual software components only partially support the capabilities that should be available....710falsefullhttps://www.spreaker.com/episode/root-causes-480-white-house-pqc-executive-order--65088723tag:soundcloud,2010:tracks/2062434016Mon, 24 Mar 2025 00:00:00 +0000Tim CallanMany people believe that the Trump White House rescinded an important cybersecurity executive order from late days of the Biden administration. We set the record straight.623falsefullhttps://www.spreaker.com/episode/root-causes-479-ai-adversarial-machine-learning--65018424tag:soundcloud,2010:tracks/2059993472Fri, 21 Mar 2025 00:00:00 +0000Tim CallanIn this episode we discuss the thinking on how adversaries can exploit the flaws in AI models to achieve unexpected and dangerous results. We explore some potential paths of defense against attacks of this sort.791falsefullhttps://www.spreaker.com/episode/root-causes-478-should-we-all-switch-from-rsa-to-ecc--64939104tag:soundcloud,2010:tracks/2056487756Mon, 17 Mar 2025 00:00:00 +0000Tim CallanRSA is under attack. Even without the quantum threat, we face the possibility of smart new exploits reducing the viable RSA key space and rendering it unsafe. In this episode we discuss the merits of choosing ECC over RSA as soon as today.962falsefullhttps://www.spreaker.com/episode/root-causes-477-comparative-security-philosophies--64863266tag:soundcloud,2010:tracks/2053413672Wed, 12 Mar 2025 00:00:00 +0000Tim CallanWe discuss how various popular computing platforms approach security and highlight the differences between them.1072falsefullhttps://www.spreaker.com/episode/root-causes-476-the-need-for-security-kpis--64801697tag:soundcloud,2010:tracks/2051426088Mon, 10 Mar 2025 00:00:00 +0000Tim CallanJason recounts a 2024 Black Hat talk about the need for objective measurements of our IT defenses and whether the good guys or bad guys are winning. Jason breaks down how to define and measure the impact of security measures.995falsefullhttps://www.spreaker.com/episode/root-causes-475-can-your-ai-scheme-against-you--64734666tag:soundcloud,2010:tracks/2048313032Thu, 06 Mar 2025 00:00:00 +0000Tim CallanIt's the stuff of science fiction! Interesting research shows how today's AI technology is capable of lying to and scheming against its human owners in service of its goals.1072falsefullhttps://www.spreaker.com/episode/root-causes-474-explaining-shor-s-algorithm--64677070tag:soundcloud,2010:tracks/2046049128Sun, 02 Mar 2025 00:00:00 +0000Tim CallanWe talk a lot about Shor's Algorithm in our discussion of post quantum cryptography (PQC). In this episode Jason explains Shor's algorithm for non-quantum physicists.1273falsefullhttps://www.spreaker.com/episode/root-causes-473-does-security-software-lack-creativity--64632053tag:soundcloud,2010:tracks/2044298648Fri, 28 Feb 2025 00:00:00 +0000Tim CallanJason reports on a 2024 Black Hat keynote about how modern software development practices inhibit innovation and invention.609falsefullhttps://www.spreaker.com/episode/root-causes-472-ai-offensive-modeling--64593213tag:soundcloud,2010:tracks/2042806264Wed, 26 Feb 2025 00:00:00 +0000Tim CallanAI tools are now available to perform red-teaming activity for DevSecOps. Such tools are soon to be table stakes in the constantly escalating IT security arms race. Join us to learn more.675falsefullhttps://www.spreaker.com/episode/root-causes-471-acme-for-pqc--64550176tag:soundcloud,2010:tracks/2041444764Sun, 23 Feb 2025 00:00:00 +0000Tim CallanIn this episode, guest Alexandre Giron explains what is needed to support post quantum cryptography (PQC) with ACME.1289falsefullhttps://www.spreaker.com/episode/root-causes-470-the-mfa-false-equivalency-fallacy--64456394tag:soundcloud,2010:tracks/2038025565Wed, 19 Feb 2025 00:00:00 +0000Tim CallanNot all forms of MFA are equally secure. In this episode we describe the differences between the more secure and less secure forms of MFA.714falsefullhttps://www.spreaker.com/episode/root-causes-469-the-all-or-nothing-fallacy-in-cybersecurity--64421810tag:soundcloud,2010:tracks/2036696852Mon, 17 Feb 2025 00:00:00 +0000Tim CallanIn this episode we explain the all-or-nothing fallacy in cybersecurity and how it's affecting debate in the WebPKI right now.435falsefullhttps://www.spreaker.com/episode/root-causes-468-uk-demands-new-backdoor-from-apple--64382866tag:soundcloud,2010:tracks/2034665888Fri, 14 Feb 2025 00:00:00 +0000Tim CallanA new demand from the UK seeks complete access to all Apple cloud data housed in the UK, regardless of the data owners' citizenship and residency. We unpack this latest development in Government versus Encryption.626falsefullhttps://www.spreaker.com/episode/root-causes-467-decoupling-public-from-private-use-cases--64346856tag:soundcloud,2010:tracks/2032792768Wed, 12 Feb 2025 00:00:00 +0000Tim CallanThe past year has seen a great deal of focus on the use of public TLS certificates where private root certificates are actually the appropriate solution. In this episode we discuss the differences between these two use cases and what IT organizations...582falsefullhttps://www.spreaker.com/episode/root-causes-466-apple-moves-47-day-ballot-to-cabf-vote--64300053tag:soundcloud,2010:tracks/2030851460Sun, 09 Feb 2025 00:00:00 +0000Tim CallanApple is proceeding with a ballot that eventually will shorten SSL certificate maximum term to 47 days. Accompanying the ballot, Apple released a statement explaining its intent with the ballot. In this episode we unpack its statements.1882falsefullhttps://www.spreaker.com/episode/root-causes-465-twelve-bugzilla-sins-for-cas-to-avoid--64255638tag:soundcloud,2010:tracks/2028856520Fri, 07 Feb 2025 00:00:00 +0000Tim CallanIn the wake of the Bugzilla Bloodbath, we list and describe twelve sins CAs commit on Bugzilla and its like, why they're detrimental, and how CAs should avoid them.2570falsefullhttps://www.spreaker.com/episode/root-causes-464-defending-against-harvest-and-decrypt--64213190tag:soundcloud,2010:tracks/2026921772Wed, 05 Feb 2025 00:00:00 +0000Tim CallanHarvest and decrypt is a well-known attack vector against traditional cryptography prior to PQC. In this episode, we discuss what enterprises should be doing today to defend themselves against harvest and decrypt.590falsefullhttps://www.spreaker.com/episode/root-causes-463-cellular-networks-are-insecure--64181739tag:soundcloud,2010:tracks/2025470748Mon, 03 Feb 2025 00:00:00 +0000Tim CallanIn this episode we explain that all cellular networks, contrary to popular belief, are fundamentally insecure.742falsefullhttps://www.spreaker.com/episode/root-causes-462-crypto-war-3-0--64092284tag:soundcloud,2010:tracks/2022889132Fri, 31 Jan 2025 00:00:00 +0000Tim CallanIn this episode we walk through the evolution of the war on cryptography, from the beginning up through today, terminating in what we call Crypto War 3.0.1338falsefullhttps://www.spreaker.com/episode/root-causes-461-sectigo-acquires-entrust-public-ca-business--64008433tag:soundcloud,2010:tracks/2021187861Wed, 29 Jan 2025 00:00:00 +0000Tim CallanSectigo today announced the acquisition of the Entrust public CA business. Entrust will go forward as a Sectigo reseller. Join us to learn the details.629falsefullhttps://www.spreaker.com/episode/root-causes-460-the-state-of-pqc-with-michele-mosca--63965177tag:soundcloud,2010:tracks/2020337037Tue, 28 Jan 2025 00:00:00 +0000Tim CallanIn this episode we are joined by Dr. Michela Mosca. We discuss his pioneering work identifying the need for post-quantum cryptography, where PQC stands today, and what the future may hold.1909falsefullhttps://www.spreaker.com/episode/root-causes-459-2024-lookback-shortening-certificate-lifespans-dcv--63880978tag:soundcloud,2010:tracks/2017418741Fri, 24 Jan 2025 00:00:00 +0000Tim Callan2024 set in motion major changes for certificate lifespans and DCV. In this episode we discuss the Apple 47-day proposal, stepping down certificate term, public versus private CA use cases, DCV reuse periods, MPIC, WHOIS, and other topics.741falsefullhttps://www.spreaker.com/episode/root-causes-458-apple-extends-entrust-distrust-to-smime-and-vmc--63765187tag:soundcloud,2010:tracks/2013232903Sun, 19 Jan 2025 00:00:00 +0000Tim CallanApple has added itself to the Entrust distrust and has extended this distrust to S/MIME and VMC. We explain.528falsefullhttps://www.spreaker.com/episode/root-causes-457-2024-lookback-guests--63727969tag:soundcloud,2010:tracks/2011271827Fri, 17 Jan 2025 00:00:00 +0000Tim CallanWe had a remarkable year on the Root Causes podcast in terms of our guests. We look back at the extremely expert guests we were lucky to talk about in 2024.687falsefullhttps://www.spreaker.com/episode/root-causes-456-2024-lookback-bugzilla-bloodbath--63687542tag:soundcloud,2010:tracks/2009041287Tue, 14 Jan 2025 00:00:00 +0000Tim CallanIn this 2024 lookback episode, we give an overview of the firestorm of Bugzilla incidents that we refer to as the Bugzilla Bloodbath. The Bugzilla Bloodbath affected actions around the Entrust distrust, delayed revocation reform, 47-day SSL...685falsefullhttps://www.spreaker.com/episode/root-causes-455-pqc-standardization-in-ietf--63641712tag:soundcloud,2010:tracks/2006139379Wed, 08 Jan 2025 00:00:00 +0000Tim CallanWe talk with guest Sofia Celi of Brave Browser, who leads the IETF PQC standardization effort, about the process of setting standards for PQC-compatible digital certificates. We learn about expected timelines, hybrid strategies, the NIST PQC onramp's...2155falsefullhttps://www.spreaker.com/episode/root-causes-454-2024-lookback-post-quantum-cryptography-pqc--63593029tag:soundcloud,2010:tracks/2002529759Thu, 02 Jan 2025 00:00:00 +0000Tim Callan2024 was an eventful year for post quantum cryptography (PQC). This includes FIPS standards, the PQC onramp, and the dawn of widespread interest among IT professionals.466falsefullhttps://www.spreaker.com/episode/root-causes-453-it-turns-out-monkeys-couldn-t-type-shakespeare-after-all--63550137tag:soundcloud,2010:tracks/1999604727Thu, 02 Jan 2025 00:00:00 +0000Tim CallanThe old adage states that a monkey in front of a keyboard, given enough time, could randomly type the works of Shakespeare. Apparently, someone ran the numbers and said not so much. We break it down and explain why we're discussing this on a PKI podcast.853falsefullhttps://www.spreaker.com/episode/root-causes-452-2024-predictions-scorecard--63523061tag:soundcloud,2010:tracks/1997604011Thu, 26 Dec 2024 00:00:00 +0000Tim CallanWe go over our predictions for 2024 and score our ability as prognosticators.639falsefullhttps://www.spreaker.com/episode/root-causes-451-a-year-in-cabf-ballots--63477430tag:soundcloud,2010:tracks/1994787347Thu, 26 Dec 2024 00:00:00 +0000Tim CallanIt was a crazy year for CA/Browser Forum activity, with nearly three times the normal number of ballots. Guest Martijn Katerbarg goes over the 32 CABF ballots from 2024.2089falsefullhttps://www.spreaker.com/episode/root-causes-450-2025-predictions--63450001tag:soundcloud,2010:tracks/1992842707Mon, 23 Dec 2024 00:00:00 +0000Tim CallanWe make our 2025 predictions. Topics include maximum certificate term, AI, post-quantum cryptography (PQC), deep fakes, and more.2910falsefullhttps://www.spreaker.com/episode/root-causes-449-what-is-a-quantum-safe-hsm--63400476tag:soundcloud,2010:tracks/1990147511Wed, 18 Dec 2024 00:00:00 +0000Tim CallanRepeat guest Bruno Coulliard of Crypto4A joins us to define a quantum-safe (or PQC enabled) hardware security module.1429falsefullhttps://www.spreaker.com/episode/root-causes-448-the-privilege-of-being-a-public-ca--63357686tag:soundcloud,2010:tracks/1988187447Tue, 17 Dec 2024 00:00:00 +0000Tim CallanWe go over Tim's September 2024 keynote speech at ENISA CA Day, "The Privilege of Being a Public CA."1540falsefullhttps://www.spreaker.com/episode/root-causes-447-nist-deprecates-rsa-2048-and-ecc-256--63321788tag:soundcloud,2010:tracks/1985034099Fri, 13 Dec 2024 00:00:00 +0000Tim CallanAs part of its post-quantum cryptography (PQC) initiative NIST has released a draft deprecating RSA-2048 and ECC 256 by 2030 and disallowing them by 2035. We get into the details.827falsefullhttps://www.spreaker.com/episode/root-causes-446-sectigo-assumes-five-cabf-offices--63286017tag:soundcloud,2010:tracks/1982042035Thu, 12 Dec 2024 00:00:00 +0000Tim CallanTim has stepped into the position of vice-chair of the CA/Browse Forum, and Sectigo now holds five chair or vice-chair positions in that body. We explain how leadership is chosen, the offices Sectigo holds today, and some of our vision for CABF in...801falsefullhttps://www.spreaker.com/episode/root-causes-445-seven-reasons-to-shorten-certificate-lifespans--63241595tag:soundcloud,2010:tracks/1977851671Mon, 09 Dec 2024 00:00:00 +0000Tim CallanWe take a deep dive into the seven reasons shorter certificate lifespans are better.1677falsefullhttps://www.spreaker.com/episode/root-causes-444-what-happens-to-the-webpki-if-google-sells-chrome--63189302tag:soundcloud,2010:tracks/1975298595Fri, 06 Dec 2024 00:00:00 +0000Tim CallanWe discuss how a potential break of Chrome from Google would affect the WebPKI. We look at product changes, resourcing, post-quantum cryptography (PQC), innovation, moonshot initiatives, and other public CAs.1166falsefullhttps://www.spreaker.com/episode/root-causes-443-is-msca-going-away--63126558tag:soundcloud,2010:tracks/1972603803Sun, 01 Dec 2024 00:00:00 +0000Tim CallanIn this episode we discuss the challenges for enterprises using Microsoft Active Directory Certificate Services (ADCS).803falsefullhttps://www.spreaker.com/episode/root-causes-442-apple-proposal-to-reduce-ssl-lifespan-updated--63007147tag:soundcloud,2010:tracks/1967062967Mon, 25 Nov 2024 00:00:00 +0000Tim CallanApple has published an updated draft to its proposal for shortening the lifespan of SSL certificates, including a final maximum term of 47 rather than 45 days. We explain.1334falsefullhttps://www.spreaker.com/episode/root-causes-441-new-white-house-initiative-targets-bgp--62972261tag:soundcloud,2010:tracks/1965001483Fri, 22 Nov 2024 00:00:00 +0000Tim CallanA new White House initiative requires that federal agencies need to create plans to thwart BGP attacks. We discuss, including Resource PKI (RPKI) and Multi-Perspective Issuance Corroboration (MPIC).893falsefullhttps://www.spreaker.com/episode/root-causes-440-public-key-directories--62793270tag:soundcloud,2010:tracks/1961462419Mon, 18 Nov 2024 00:00:00 +0000Tim CallanWe talk about public key directories and complicating factors such as Tailscale, VPN, TOR, Cloudflare, and Zero Trust.778falsefullhttps://www.spreaker.com/episode/root-causes-439-pqc-onramp-narrowed-down-to-15-candidates--62758143tag:soundcloud,2010:tracks/1959260607Fri, 15 Nov 2024 00:00:00 +0000Tim CallanNIST has narrowed its PQC onramp contest to 15 candidates. We go over who remains and the makeup of the remaining candidates.1034falsefullhttps://www.spreaker.com/episode/root-causes-438-pqc-is-an-existential-requirement--62710624tag:soundcloud,2010:tracks/1956475447Tue, 12 Nov 2024 00:00:00 +0000Tim CallanRepeat guest Bruno Couillard argues that cryptography is part of the foundational fabric of our lives and that the transition to PQC is an existential requirement.1700falsefullhttps://www.spreaker.com/episode/root-causes-437-don-t-blame-the-linter--62623689tag:soundcloud,2010:tracks/1950186751Tue, 05 Nov 2024 00:00:00 +0000Tim CallanLinters are essential tools for maintaining quality of certificate issuance. Public open-source linters are available to help CAs assure compliance. As a result, CAs have begun attributing gaps in coverage by public linters as the root cause for...682falsefullhttps://www.spreaker.com/episode/root-causes-436-formal-proofs--62546833tag:soundcloud,2010:tracks/1945040723Tue, 29 Oct 2024 00:00:00 +0000Tim CallanFormal proofs are critical to cryptography. We discuss how better processes and AI can accelerate formal proofs of cryptographic concepts.623falsefullhttps://www.spreaker.com/episode/root-causes-435-the-pqc-q-day-is-not-that-simple--62503481tag:soundcloud,2010:tracks/1941928931Fri, 25 Oct 2024 00:00:00 +0000Tim CallanThe PQC community likes to debate when crypto relevant quantum computers will be available, which is sometimes called "Q day." In this episode we explain how radically oversimplified this concept is and dive into the nuances of what a...1186falsefullhttps://www.spreaker.com/episode/root-causes-434-did-researchers-break-aes-using-quantum-annealing--62466271tag:soundcloud,2010:tracks/1939617755Tue, 22 Oct 2024 00:00:00 +0000Tim CallanNews reports claim Chinese researchers broke AES with a quantum annealing computer. We clarify the details and talk about the implications of this reported discovery.704falsefullhttps://www.spreaker.com/episode/root-causes-433-will-ai-eat-all-the-electricity--62401294tag:soundcloud,2010:tracks/1936652567Thu, 17 Oct 2024 00:00:00 +0000Tim CallanWe explore the question of whether or not we have enough electricity to fuel AI's expected growth.629falsefullhttps://www.spreaker.com/episode/root-causes-432-apple-floats-new-short-lived-certificate-proposal--62362728tag:soundcloud,2010:tracks/1934900699Mon, 14 Oct 2024 00:00:00 +0000Tim CallanApple recently floated a draft CABF ballot for commentary that steps down maximum term for SSL certificates starting next year and eventually landing at 45 days in 2027. We share the details.1581falsefullhttps://www.spreaker.com/episode/root-causes-431-new-mozilla-proposal-to-combat-delayed-revocation--62334832tag:soundcloud,2010:tracks/1933401902Fri, 11 Oct 2024 00:00:00 +0000Tim CallanDeliberate delay of mandatory revocations has plagued the WebPKI in 2024. A new proposed policy from Mozilla stands to eliminate most of this behavior. In this episode we go over the proposal and explain its potential consequences.1691falsefullhttps://www.spreaker.com/episode/root-causes-430-how-does-a-tls-handshake-work--62301469tag:soundcloud,2010:tracks/1931716754Wed, 09 Oct 2024 00:00:00 +0000Tim CallanIn this episode we give a high-level explanation of what happens in a TLS 1.3 handshake and then discuss what will happen when PQC is included.872falsefullhttps://www.spreaker.com/episode/root-causes-429-servicenow-outage-due-to-expired-root-certificate--62286325tag:soundcloud,2010:tracks/1931100317Tue, 08 Oct 2024 00:00:00 +0000Tim CallanA ServiceNow private CA root expired, creating outages across hundreds of enterprises. We explain what appears to have gone on.425falsefullhttps://www.spreaker.com/episode/root-causes-428-mobi-attack-puts-whois-based-dcv-into-question--62235735tag:soundcloud,2010:tracks/1928975426Fri, 04 Oct 2024 00:00:00 +0000Tim CallanWhite hat researchers managed to take over WHOIS for the .mobi TLD. Among other things, this discovery foretells the death of WHOIS as a valid email source for Domain Control Validation (DCV).1031falsefullhttps://www.spreaker.com/episode/root-causes-427-mapping-clm-to-nist-csf-2-0--62199378tag:soundcloud,2010:tracks/1927650551Tue, 01 Oct 2024 00:00:00 +0000Tim CallanIn this episode we map the contributions of Certificate Lifecycle Management into the new NIST Cybersecurity Framework 2.0.947falsefullhttps://www.spreaker.com/episode/root-causes-426-expired-certificate-takes-down-bank-of-england--62167759tag:soundcloud,2010:tracks/1926367928Mon, 30 Sep 2024 00:00:00 +0000Tim CallanA certificate expiration is now known to have created July's outage of Bank of England. Join us as we shake our heads in amazement yet again.463falsefullhttps://www.spreaker.com/episode/root-causes-425-pqc-requirements-for-voting-systems--62131925tag:soundcloud,2010:tracks/1924900076Fri, 27 Sep 2024 00:00:00 +0000Tim CallanIn honor of the upcoming US elections, we describe the six main requirements for a post-quantum voting system.654falsefullhttps://www.spreaker.com/episode/root-causes-424-using-lora-iot-protocol-for-clandestine-communications--62099677tag:soundcloud,2010:tracks/1923108524Wed, 25 Sep 2024 00:00:00 +0000Tim CallanIn this episode we describe the LoRA protocol, which allows IoT devices to communicate securely without using a cellular network, and how it can be used for secret communications.704falsefullhttps://www.spreaker.com/episode/root-causes-423-is-a-certificate-software-or-a-service--62043464tag:soundcloud,2010:tracks/1920227681Fri, 20 Sep 2024 00:00:00 +0000Tim CallanIn this episode we discuss the dual nature of a public certificate as both a file and part of a holistic service that lasts until its expiration. We discuss revocation checking, CT logging, GAAP accounting, linters, certificate tracking tools,...1109falsefullhttps://www.spreaker.com/episode/root-causes-422-new-date-for-entrust-distrust--62030439tag:soundcloud,2010:tracks/1919415614Thu, 19 Sep 2024 00:00:00 +0000Tim CallanThe Chrome root program has changed the date for the Entrust distrust. Join us to get the details.268falsefullhttps://www.spreaker.com/episode/root-causes-421-fido-2-implementation-problems--61850806tag:soundcloud,2010:tracks/1917684677Mon, 16 Sep 2024 00:00:00 +0000Tim CallanWhite hat researchers have raised concerns about FIDO 2 (AKA WebAuthn). We explain.508falsefullhttps://www.spreaker.com/episode/root-causes-420-new-side-channel-attack-against-yubikeys--61494751tag:soundcloud,2010:tracks/1916210366Fri, 13 Sep 2024 00:00:00 +0000Tim CallanEUCLEAK, a newly revealed side channel vulnerability, can clone the contents of a YubiKey. We talk about the attack and its significance.764falsefullhttps://www.spreaker.com/episode/root-causes-419-what-happens-to-vendors-who-don-t-support-acme-when-90-day-certificates-come--61327279tag:soundcloud,2010:tracks/1914084548Mon, 09 Sep 2024 00:00:00 +0000Tim CallanThough it is the closest thing to an industry-standard API, there are still products and operating systems that don't support ACME. In this episode we explore what happens to these products once 90-day SSL certificates become the requirement.975falsefullhttps://www.spreaker.com/episode/root-causes-418-moving-from-cryptographic-homogeneity-to-cryptographic-heterogeneity--61285973tag:soundcloud,2010:tracks/1911607607Fri, 06 Sep 2024 16:48:26 +0000Tim CallanOne seldom discussed consequence of quantum computers and PQC is the move from cryptographic homogeneity to cryptographic heterogeneity, with multiple KEMs and DSAs eventually expected as ongoing standards. We examine the consequences of this change.1106falsefullhttps://www.spreaker.com/episode/root-causes-417-introducing-pkimetal-the-pki-meta-linter--61255600tag:soundcloud,2010:tracks/1909670810Tue, 03 Sep 2024 00:00:00 +0000Tim CallanWe introduce pkimetal, an open source project from Rob Stradling that allows CA to write to many popular linters with a single integration. We explain the importance and pitfalls of linters and how pkimetal improves linter implementation.525falsefullhttps://www.spreaker.com/episode/root-causes-416-ssl-subscriber-uses-a-restraining-order-to-prevent-revocation--61215107tag:soundcloud,2010:tracks/1907262590Thu, 29 Aug 2024 00:00:00 +0000Tim CallanAn enterprise SSL subscriber recently used a Temporary Restraining Order to prevent the proper revocation of misissued certificates. We explain what happened, why it's deeply problematic, how the industry might consider responding.1360falsefullhttps://www.spreaker.com/episode/root-causes-415-what-can-i-do-with-these-new-fips-pqc-standards--61175385tag:soundcloud,2010:tracks/1905065672Tue, 27 Aug 2024 00:00:00 +0000Tim CallanNIST recently released PQC algorithmic standards in FIPS-203, FIPS-204, and FIPS-205 (ML-KEM, ML-DSA, and SLH-DSA). We describe what is necessary for enterprises to begin using these algorithms.1174falsefullhttps://www.spreaker.com/episode/root-causes-414-what-are-the-revocation-periods-for-public-certificates--61127722tag:soundcloud,2010:tracks/1902812710Fri, 23 Aug 2024 00:00:00 +0000Tim CallanIn this episode we detail the mandatory revocation periods for leaf certificates and intermediates and explain when a 24-hour versus a 120-hour revocation deadline applies.718falsefullhttps://www.spreaker.com/episode/root-causes-413-nist-releases-standards-for-first-three-pqc-algorithms--61054928tag:soundcloud,2010:tracks/1898656380Fri, 16 Aug 2024 00:00:00 +0000Tim CallanOn August 13, 2024, NIST released its first three standards for PQC algorithms, ML-KEM, ML-DSA, and SLH-DSA. We tell you where to find them and talk about what happens next.436falsefullhttps://www.spreaker.com/episode/root-causes-412-google-throws-in-the-towel-on-eliminating-cookies--61016359tag:soundcloud,2010:tracks/1896617820Tue, 13 Aug 2024 00:00:00 +0000Tim CallanCookies are incredibly useful but also pose grave privacy concerns. We have in the past covered Chrome's initiatives to replace cookies. Now Chrome has announced that for the foreseeable future cookies will remain. We explain.595falsefullhttps://www.spreaker.com/episode/root-causes-411-pqc-security-levels--60971595tag:soundcloud,2010:tracks/1893269022Fri, 09 Aug 2024 00:00:00 +0000Tim CallanA popular belief is that Grover's algorithm will require that we double our AES key sizes. Repeat guest Bas Westerbaan of Cloudflare explains why this myth is incorrect and talks through the concept of "security levels" in post-quantum cryptography.1229falsefullhttps://www.spreaker.com/episode/root-causes-410-crowdstrike-automatic-updates-and-walled-gardens--60940291tag:soundcloud,2010:tracks/1890673497Tue, 06 Aug 2024 00:00:00 +0000Tim CallanWe examine one specific aspect of the recent CrowdStrike flaw. Microsoft blames the problem on the fact that it must, by European law, allow kernel updates to Windows. We unpack the challenges this poses.929falsefullhttps://www.spreaker.com/episode/root-causes-409-mozilla-distrusts-entrust--60904994tag:soundcloud,2010:tracks/1887737583Fri, 02 Aug 2024 00:00:00 +0000Tim CallanThis week Mozilla chose to follow Chrome in deprecating the Entrust trusted roots. We give you the details and explain why this action matters.889falsefullhttps://www.spreaker.com/episode/root-causes-408-takeaways-from-recent-conversations-with-pqc-experts--60862753tag:soundcloud,2010:tracks/1884629268Mon, 29 Jul 2024 00:00:00 +0000Tim CallanIn the past three months we featured far-ranging conversations about post-quantum cryptography (PQC) with experts Bas Westerbaan of Cloudflare, Dustin Moody of NIST, and Bruno Coulliard of Crypto4A. In this episode we recap important takeaways from...783falsefullhttps://www.spreaker.com/episode/root-causes-407-whatever-happened-to-passkeys--60816894tag:soundcloud,2010:tracks/1881695526Thu, 25 Jul 2024 00:00:00 +0000Tim CallanWebAuthn arrived last year with great fanfare. But here we are in the latter half of 2024, and they are rarely used. In this episode we discuss why.806falsefullhttps://www.spreaker.com/episode/root-causes-406-certificate-discovery-is-for-internal-certificates-too--60781496tag:soundcloud,2010:tracks/1879320669Mon, 22 Jul 2024 00:00:00 +0000Tim CallanWhen we discuss certificate discovery in CLM platforms, there is a common assumption that we're talking about public certificates exclusively. In this episode we explain the value of certificate discovery for internal PKI certificates also.1096falsefullhttps://www.spreaker.com/episode/root-causes-405-what-is-an-adversarial-self-replicating-prompt--60745818tag:soundcloud,2010:tracks/1876016199Fri, 19 Jul 2024 00:00:00 +0000Tim CallanIn this episode we explain what an adversarial, self-replicating prompt, otherwise known as a prompt worm.1505falsefullhttps://www.spreaker.com/episode/root-causes-404-scotus-ruling-will-change-it-security-regulation--60710460tag:soundcloud,2010:tracks/1873305657Tue, 16 Jul 2024 00:00:00 +0000Tim CallanThe US Supreme Court has struck down the Chevron Deferment, which greatly expanded federal agencies' power to interpret and enforce statutes. This monumental ruling stands to shift power considerably from agencies to courts and will put more pressure...966falsefullhttps://www.spreaker.com/episode/root-causes-403-nist-pqc-contest-round-4-and-onramp-with-dustin-moody--60675948tag:soundcloud,2010:tracks/1870037571Fri, 12 Jul 2024 00:00:00 +0000Tim CallanWe are joined again by Dustin Moody, who leads the NIST search for PQC algorithms. In this episode Dustin describes going-forward efforts, including Round 4 of the NIST contest and the Onramp. We discuss some of the candidate algorithms and the...1294falsefullhttps://www.spreaker.com/episode/root-causes-402-new-social-engineering-powershell-attack--60645077tag:soundcloud,2010:tracks/1867383906Tue, 09 Jul 2024 00:00:00 +0000Tim CallanA new social engineering exploit instructs victims to enter command line prompts to hack themselves on behalf of the hacker. We explain and discuss potential responses.921falsefullhttps://www.spreaker.com/episode/root-causes-401-new-ssh-remote-code-execution-vulnerability-revealed--60612473tag:soundcloud,2010:tracks/1864018266Fri, 05 Jul 2024 00:00:00 +0000Tim CallanA newly revealed OpenSSH vulnerability can open enterprises to remote code execution. We explain what is happening, why you should care, and what to do about it.620falsefullhttps://www.spreaker.com/episode/root-causes-400-french-court-orders-dns-poisoning--60581738tag:soundcloud,2010:tracks/1861167417Tue, 02 Jul 2024 00:00:00 +0000Tim CallanTo combat piracy of sporting event transmissions, a French court has ordered major tech companies including Google and Cloudflare to poison DNS settings. In this episode we provide some detail and generally marvel at this strange decision.638falsefullhttps://www.spreaker.com/episode/root-causes-399-entrust-distrusted--60540957tag:soundcloud,2010:tracks/1858655787Fri, 28 Jun 2024 00:00:00 +0000Tim CallanOn June 27, 2024 Google Chrome announced it was distrusting Entrust as a public CA starting November 1, 2024. We explain what to expect, go over Google's stated reasons, and share some of what lead up to this.1181falsefullhttps://www.spreaker.com/episode/root-causes-398-history-of-the-nist-pqc-contest-with-dustin-moody--60529950tag:soundcloud,2010:tracks/1857954651Thu, 27 Jun 2024 00:00:00 +0000Tim CallanIn this episode we are joined by Dr. Dustin Moody, leader of the NIST post-quantum cryptography contest. Dustin gives us an inside view of the background behind NIST's decision to run the contest and how we got to where we are today.1534falsefullhttps://www.spreaker.com/episode/root-causes-397-all-post-quantum-systems-are-terrible--60494755tag:soundcloud,2010:tracks/1856025987Mon, 24 Jun 2024 00:00:00 +0000Tim CallanIn this new conversation with Bas Westerbaan of Cloudflare, we reveal that all existing PQC systems present significant problems for incorporation into our existing ecosystems. We explain the problems with existing systems and some options for what to...1692falsefullhttps://www.spreaker.com/episode/root-causes-396-the-trouble-with-microsoft-recall--60465281tag:soundcloud,2010:tracks/1853894970Fri, 21 Jun 2024 00:00:00 +0000Tim CallanMicrosoft has proposed a feature called Recall that uses screen images to fuel AI-assisted capabilities. This has raised fears about the security decisions around this capability. We talk about why and how the proposed technology has resultingly...847falsefullhttps://www.spreaker.com/episode/root-causes-395-is-y2q-like-y2k--60425118tag:soundcloud,2010:tracks/1851124068Tue, 18 Jun 2024 00:00:00 +0000Tim CallanIn this episode we compare the advent of cryptography relevancy of quantum computers (somestimes called Y2Q) to Y2K. We uncover similarities and differences and discuss how they govern decision making between now and Y2Q.1461falsefullhttps://www.spreaker.com/episode/root-causes-394-snowflake-ticketmaster-and-mfa--60385199tag:soundcloud,2010:tracks/1847409738Fri, 14 Jun 2024 00:00:00 +0000Tim CallanIn this episode we drill down on one aspect of the loss of more than 500 million Ticketmaster users' data, which is the use of MFA for access to the Snowflake platform.671falsefullhttps://www.spreaker.com/episode/root-causes-393-pqc-enabled-chrome-breaks-other-software--60353229tag:soundcloud,2010:tracks/1845010083Tue, 11 Jun 2024 00:00:00 +0000Tim CallanChrome's recent 124 release supports PQC algorithms from NIST. This has led to the discovery of software and systems that break under these circumstances. We explain what happened, why, and what to do about it.746falsefullhttps://www.spreaker.com/episode/root-causes-392-chromium-issues-a-quality-ultimatum--60314291tag:soundcloud,2010:tracks/1841274570Fri, 07 Jun 2024 00:00:00 +0000Tim CallanIn the most recent CA/Browser Forum face-to-face meeting, the Google Chrome root program gave a presentation clearly defining its expectations for quality of incident reporting from CAs with an eye to where many CAs have been failing. We relate...1278falsefullhttps://www.spreaker.com/episode/root-causes-391-20-percent-of-web-visits-are-pqc-enabled-today--60277943tag:soundcloud,2010:tracks/1837730097Tue, 04 Jun 2024 00:00:00 +0000Tim CallanCloudflare research engineer Bas Westerbaan joins us to share his observations about post-quantum cryptography and what it does in the real world. We talk about the pragmatic needs of moving the internet for PQC and speculate about timelines for...1350falsefullhttps://www.spreaker.com/episode/root-causes-390-chromium-boosts-its-distrust-agility-with-a-new-root-trust-deprecation--60239681tag:soundcloud,2010:tracks/1834714758Fri, 31 May 2024 00:00:00 +0000Tim CallanA root trust deprecation highlights new Chrome functionality that enables more agile and less disruptive distrust events. We explain the significant of this event.1314falsefullhttps://www.spreaker.com/episode/root-causes-389-2024-rsa-conference-wrap-up--60201286tag:soundcloud,2010:tracks/1832334870Tue, 28 May 2024 19:00:40 +0000Tim CallanJason and I do our annual RSA wrap-up. Trending segments include AI, Trust Centers, MFA, PQC, and more.1644falsefullhttps://www.spreaker.com/episode/root-causes-388-what-is-the-webpki--60129128tag:soundcloud,2010:tracks/1827626145Wed, 22 May 2024 00:00:00 +0000Tim CallanThese days we frequently discuss "the WebPKI." But what does that really mean? In this episode we define the term and explain how this definition evolved over time. We give an inventory of a main components of the WebPKI and discuss what's required...1575falsefullhttps://www.spreaker.com/episode/root-causes-387-what-is-the-post-quantum-readiness-of-hsms--60066421tag:soundcloud,2010:tracks/1823735208Thu, 16 May 2024 00:00:00 +0000Tim CallanWe take a deep dive with return guest Bruno Coulliard on HSMs and the role they play in post-quantum cryptography (PQC).1894falsefullhttps://www.spreaker.com/episode/root-causes-386-meta-commits-mitm-attack-on-its-users--60006654tag:soundcloud,2010:tracks/1820978577Mon, 13 May 2024 00:00:00 +0000Tim CallanRecent court documents reveal that in 2016 Meta (then Facebook) set up a system to get around encryption and spy on traffic between its users and competing social media platforms. We explain what happened.864falsefullhttps://www.spreaker.com/episode/root-causes-385-failed-revocation-and-wildcard-certificates--59969277tag:soundcloud,2010:tracks/1819066581Fri, 10 May 2024 00:00:00 +0000Tim CallanWe discuss misuse of wildcard certificates, failure to revoke on time, and how these two failures magnify each other.740falsefullhttps://www.spreaker.com/episode/root-causes-384-so-what-is-a-senior-fellow-anyway--59891101tag:soundcloud,2010:tracks/1816236660Tue, 07 May 2024 00:00:00 +0000Tim CallanJason has a new title, Senior Fellow. In this episode Jason explains what his new focus will be and how this will be good for Root Causes.443falsefullhttps://www.spreaker.com/episode/root-causes-383-delayed-revocation-events-by-the-numbers--59774949tag:soundcloud,2010:tracks/1812635115Thu, 02 May 2024 00:00:00 +0000Tim CallanAn epidemic of delayed revocations has infected the public CA community. We track delayed revocations since the beginning of 2021, examine the trend line, and discuss root causes.1529falsefullhttps://www.spreaker.com/episode/root-causes-382-mobile-phone-malware-steals-faces-for-access--59704939tag:soundcloud,2010:tracks/1810508940Mon, 29 Apr 2024 00:00:00 +0000Tim CallanNew malware photographs users' faces to defeat authentication mechanisms. We explain the that biometrics are not "secrets" and discuss the continuing progression of attacks to steal biometrics.703falsefullhttps://www.spreaker.com/episode/root-causes-381-apple-chip-sideloading-attack-leaks-encryption-keys--59668018tag:soundcloud,2010:tracks/1808605410Fri, 26 Apr 2024 00:00:00 +0000Tim CallanA newly revealed side channel attack enables theft of private keys from M-series Apple chips. We explain.451falsefullhttps://www.spreaker.com/episode/root-causes-380-what-if-quantum-supremacy-comes-earlier-than-we-thought--59614419tag:soundcloud,2010:tracks/1806091554Mon, 22 Apr 2024 00:00:00 +0000Tim CallanRepeat guest Bruno Coulliard gives us an update on the US government's migration to post-quantum cryptography (PQC). We talk about the challenges to migration, the possibility of a black swan event in achieving quantum supremacy, and what happens if...1772falsefullhttps://www.spreaker.com/episode/root-causes-379-ai-generated-fake-ids-for-kyc--59530775tag:soundcloud,2010:tracks/1803042201Thu, 18 Apr 2024 00:00:00 +0000Tim CallanInexpensive and easily obtained deepfake photographs of IDs, generated by AI, are available online. These pose a problem for KYC initiatives.809falsefullhttps://www.spreaker.com/episode/root-causes-378-why-are-forced-revocations-so-difficult--59475960tag:soundcloud,2010:tracks/1801269930Mon, 15 Apr 2024 00:00:00 +0000Tim CallanIn the latest in our ongoing series of discussions of the Bugzilla Bloodbath, we delve deep into the problem of failure to revoke on time and the multiple causes that lead to this ongoing failure. And what to do about them.1268falsefullhttps://www.spreaker.com/episode/root-causes-377-is-cps-issuance-misalignment-a-revocation-event--59423330tag:soundcloud,2010:tracks/1798606657Thu, 11 Apr 2024 00:00:00 +0000Tim CallanIf you issue public certificates that are fully compliant except that they do not reflect what your CPS says, are they misissued? Do they require revocation? This is a question with real stakes as we see multiple current instances of a CA denying...1027falsefullhttps://www.spreaker.com/episode/root-causes-376-gartner-s-new-clm-framework--59355930tag:soundcloud,2010:tracks/1796481337Mon, 08 Apr 2024 00:00:00 +0000Tim CallanGartner has released a new framework for Certificate Lifecycle Management, called the Seven Core Functions of Certificate Automation. We walk through this framework and answer how it fits in with our own Five Pillars of CLM.1170falsefullhttps://www.spreaker.com/episode/root-causes-375-what-is-name-space-lifecycle-management--59314064tag:soundcloud,2010:tracks/1793965165Fri, 05 Apr 2024 00:00:00 +0000Tim CallanIn this guest episode we discuss name space hygiene with Geir Rasmussen, founder of NodeZro. CNAMEs, SPF, DMARC, name server entries, and other DNS identifiers, left unattended, can expose companies to identity-based attacks. We lay out the steps in...1680falsefullhttps://www.spreaker.com/episode/root-causes-374-nist-cyber-security-framework-2-released--59246861tag:soundcloud,2010:tracks/1789831396Sun, 31 Mar 2024 00:00:00 +0000Tim CallanNIST Cyber Security Framework version 2.0 is released. It includes guidance on identity management and authentication. In this first episode of a series, we describe this framework's basic structure and its effect on industry.872falsefullhttps://www.spreaker.com/episode/root-causes-373-massive-brand-hijack-subverts-more-than-21-000-domains-and-subdomains--59220125tag:soundcloud,2010:tracks/1787710111Fri, 29 Mar 2024 00:00:00 +0000Tim CallanA massive name space attack has hijacked more than 21,000 domains and subdomains, including a who's who list of major global brands. This huge and innovative attack takes advantage of inherited trust in abandoned domains. We explain what is happening.881falsefullhttps://www.spreaker.com/episode/root-causes-372-bugzilla-bloodbath--59180689tag:soundcloud,2010:tracks/1784895846Tue, 26 Mar 2024 00:00:00 +0000Tim CallanIt's a bloodbath on Bugzilla. Since March 9, more than 25 new Bugzilla bugs been written up, which is 10x the typical pace. And it's not over. In this episode we explain what is going on and why.1326falsefullhttps://www.spreaker.com/episode/root-causes-371-mpic-rules-go-to-cabf-ballot--59140832tag:soundcloud,2010:tracks/1781920632Fri, 22 Mar 2024 00:00:00 +0000Tim CallanA ballot for Multi-perspective Issuance Corroboration (MPIC), formerly known as MPDV, has entered a discussion period in the CA/Browser Forum (CABF). We explain the details of what it contains.1218falsefullhttps://www.spreaker.com/episode/root-causes-370-drama-on-bugzilla--59105764tag:soundcloud,2010:tracks/1779339657Tue, 19 Mar 2024 00:00:00 +0000Tim CallanAn evolving incident on Bugzilla has garnered a lot of attention and touches several important issues in the WebPKI ecosystem. We report what went on and unpack the issues involved.1659falsefullhttps://www.spreaker.com/episode/root-causes-369-imessage-to-be-pqc-enabled--59056299tag:soundcloud,2010:tracks/1775447613Fri, 15 Mar 2024 00:00:00 +0000Tim CallanApple has announced that iMessage will employ post-quantum cryptography (PQC). We explain the implications of this announcement.887falsefullhttps://www.spreaker.com/episode/root-causes-368-crystals-kyber-is-now-ml-kem--59033752tag:soundcloud,2010:tracks/1773561219Wed, 13 Mar 2024 00:00:00 +0000Tim CallanWhat has been known as CRYSTALS-Kyber now has the new official name of Module Lattice-based Key Encryption Module, or ML-KEM. We give an update on the state of the NIST round 3 winners.548falsefullhttps://www.spreaker.com/episode/root-causes-367-did-an-iot-toothbrush-botnet-perform-ddos-attacks--58957864tag:soundcloud,2010:tracks/1767953646Thu, 07 Mar 2024 00:00:00 +0000Tim CallanA story circulated earlier this year about a botnet composed of millions of IoT toothbrushes, which later was debunked. We tell you the whole tale.453falsefullhttps://www.spreaker.com/episode/root-causes-366-what-is-eidas--58924189tag:soundcloud,2010:tracks/1765059684Mon, 04 Mar 2024 00:00:00 +0000Tim CallaneIDAS 2.0 has been making headlines recently with its proposed expansion to the European digital identity ecosystem. But what is eIDAS? What does it do, and why does it exist? In this episode we give you the basics.1634falsefullhttps://www.spreaker.com/episode/root-causes-365-what-is-subdomain-hijacking--58821558tag:soundcloud,2010:tracks/1758017310Mon, 26 Feb 2024 00:00:00 +0000Tim CallanIn this episode we explain subdomain hijacking, including dangling subdomains and how they can constitute vulnerabilities.812falsefullhttps://www.spreaker.com/episode/root-causes-364-video-conference-deepfake-enables-25-million-theft--58777486tag:soundcloud,2010:tracks/1754915097Thu, 22 Feb 2024 00:00:00 +0000Tim CallanDeepfakes continue to show themselves as part of the standard criminal toolkit. A recent deepfake spear phish enabled a $25 million Business Email Compromise (BEC). We explain what happened.524falsefullhttps://www.spreaker.com/episode/root-causes-363-defending-yourself-against-use-of-stolen-privileges--58743927tag:soundcloud,2010:tracks/1751933661Sun, 18 Feb 2024 00:00:00 +0000Tim CallanCloudFlare recently published details of an attack it suffered as a downstream effect of a November 2023 breach against Okta and what it did to nullify its success. We discuss the steps enterprises can take to protect themselves against malicious use...460falsefullhttps://www.spreaker.com/episode/root-causes-362-when-you-re-attacked-by-a-state-actor--58675591tag:soundcloud,2010:tracks/1746191091Mon, 12 Feb 2024 00:00:00 +0000Tim CallanIn this episode we share the details of a recent nation state actor attack on Microsoft and some of the lessons learned.607falsefullhttps://www.spreaker.com/episode/root-causes-361-the-premise-of-on-premise--58627691tag:soundcloud,2010:tracks/1742379576Fri, 09 Feb 2024 00:00:00 +0000Tim CallanIn this episode we examine commonly held belief that on-premise systems give system administrators greater levels of control and that that is better for security or other reasons. We explore the pros and cons of extra control, to what degree it is a...2222falsefullhttps://www.spreaker.com/episode/root-causes-360-joe-biden-deepfake-plays-in-new-hampshire-primary--58588694tag:soundcloud,2010:tracks/1739495547Tue, 06 Feb 2024 00:00:00 +0000Tim CallanA deepfake of Joe Biden's voice made an appearance in robocalls leading up to the New Hampshire primary. We discuss this latest development and its implications.713falsefullhttps://www.spreaker.com/episode/root-causes-359-90-day-ssl-won-t-affect-organization-validation-periods--58547807tag:soundcloud,2010:tracks/1735840197Fri, 02 Feb 2024 00:00:00 +0000Tim CallanWith maximum 90-day term coming for public SSL certificates and DCV reuse also moving to 90 days, we explain why we do not expect a similar reduction in the reuse period for organization validation.938falsefullhttps://www.spreaker.com/episode/root-causes-358-security-questionnaire-sins--58503547tag:soundcloud,2010:tracks/1732277916Tue, 30 Jan 2024 00:00:00 +0000Tim CallanIn this episode we present a catalog of "security questionnaire sins," which are avoidable problems and errors that frequently occur in the security questionnaires enterprises send to vendors. Categories include difficulty of access, poor technical...1990falsefullhttps://www.spreaker.com/episode/root-causes-357-signed-digital-photographs--58465251tag:soundcloud,2010:tracks/1728696624Fri, 26 Jan 2024 00:00:00 +0000Tim CallanThree major camera manufacturers have joined to create a standard for signed digital images from their cameras.704falsefullhttps://www.spreaker.com/episode/root-causes-356-will-mpdv-eliminate-email-based-dcv--58420582tag:soundcloud,2010:tracks/1725553281Mon, 22 Jan 2024 00:00:00 +0000Tim CallanMulti-perspective Domain Validation (MPDV) is a necessary evolution of Domain Control Validation (DCV) to protect against Border Gateway Protocol (BGP) attacks. We explore how MPDV may affect accepted DCV methods, especially the email method.990falsefullhttps://www.spreaker.com/episode/root-causes-355-should-a-managed-pki-provider-do-whatever-the-customer-wants--58369653tag:soundcloud,2010:tracks/1722094614Fri, 19 Jan 2024 00:00:00 +0000Tim CallanIn this episode we explore whether a managed PKI provider should give complete control over PKI decisions to the end customer or if it should enforce certain minimum standards and principles regardless of what the customer asks for.1351falsefullhttps://www.spreaker.com/episode/root-causes-354-cyberslash-attack-against-crystals-kyber--58321387tag:soundcloud,2010:tracks/1719235860Tue, 16 Jan 2024 00:00:00 +0000Tim CallanA newly published attack against common implementations of CRYSTALS-Kyber illustrates how cryptographic implementations can be vulnerable even if the cyphers themselves remain sound.736falsefullhttps://www.spreaker.com/episode/root-causes-353-why-isn-t-pki-everywhere--58256265tag:soundcloud,2010:tracks/1713774612Tue, 09 Jan 2024 00:00:00 +0000Tim CallanOur hosts firmly believe that PKI is a necessary component of all digital interactions. And yet there are still gaps in PKI implementation. We discuss these gaps and why they persist.1450falsefullhttps://www.spreaker.com/episode/root-causes-352-fbi-vs-end-to-end-encryption-in-meta-apps--58198247tag:soundcloud,2010:tracks/1708200531Thu, 04 Jan 2024 00:00:00 +0000Tim CallanMeta is finally rolling out end-to-end encryption across its messaging apps. This is the latest chapter in the long story of government versus encryption. We rant a little about this.921falsefullhttps://www.spreaker.com/episode/root-causes-351-2024-predictions--58131508tag:soundcloud,2010:tracks/1701117078Wed, 27 Dec 2023 00:00:00 +0000Tim CallanWe look forward to 2024 and predict trends for PKI, certificates, and digital identity. We discuss shortening certificate lifespans, Multi-perspective Domain Validation (MPDV), eIDAS 2.0, OCSP, post-quantum cryptography (PQC), Certificate Lifecycle...1089falsefullhttps://www.spreaker.com/episode/root-causes-350-public-certificates-and-the-gdpr-right-to-be-forgotten--58088602tag:soundcloud,2010:tracks/1696295664Thu, 21 Dec 2023 00:00:00 +0000Tim CallanGDPR provides a "right to be forgotten," whereby individuals can demand the removal of PII from IT systems. This can run directly contrary to the transparency and permanence built into the DNA of public PKI systems. We explore this conundrum.927falsefullhttps://www.spreaker.com/episode/root-causes-349-2023-lookback-overall-trends--58047817tag:soundcloud,2010:tracks/1693405557Mon, 18 Dec 2023 00:00:00 +0000Tim CallanWe look back at PKI in 2023. Trends include artificial intelligence, enterprise crypto agility, the fall of OCSP, PKI everywhere, the weakness of passwords, and government versus the internet. We also look at last year's predictions and compare them...1357falsefullhttps://www.spreaker.com/episode/root-causes-348-what-is-a-merkle-tree--58020717tag:soundcloud,2010:tracks/1691294871Fri, 15 Dec 2023 16:22:34 +0000Tim CallanOne foundational element of modern cryptographic systems is the Merkle tree. Merkle tree is an enabler of blockchain and CT logs, among other things. We explain this data structure, its properties, and its use cases.726falsefullhttps://www.spreaker.com/episode/root-causes-347-2023-lookback-shortening-certificate-lifespans--57978377tag:soundcloud,2010:tracks/1687927818Mon, 11 Dec 2023 00:00:00 +0000Tim Callan90-day SSL certificates is only part of it! 2023 has been a year of certificate lifespans getting shorter. We review these trends.1124falsefullhttps://www.spreaker.com/episode/root-causes-346-private-credentials-in-public-code--57955175tag:soundcloud,2010:tracks/1685920107Fri, 08 Dec 2023 00:00:00 +0000Tim CallanIn this episode we uncover the epidemic of private credentials in public-facing code repositories, including why it occurs and what do to about it.930falsefullhttps://www.spreaker.com/episode/root-causes-345-apple-versus-european-sideloading--57922679tag:soundcloud,2010:tracks/1683182409Tue, 05 Dec 2023 00:00:00 +0000Tim CallanThe European Union is applying pressure to Apple to allow sideloading of applications. We go over why this is occurring, the potential dangers, and Apple's response.761falsefullhttps://www.spreaker.com/episode/root-causes-344-introducing-the-pqc-onramp--57853679tag:soundcloud,2010:tracks/1677767325Wed, 29 Nov 2023 00:00:00 +0000Tim CallanNIST's Round 3 competition has yielded winners for standardization. But NIST wants to continue finding additional potential algorithms, especially those using non-Lattice schemes. We explain the PQC "onramp" and what we should expect.1017falsefullhttps://www.spreaker.com/episode/root-causes-343-the-eidas-2-0-controversy--57769776tag:soundcloud,2010:tracks/1671976164Wed, 22 Nov 2023 00:00:00 +0000Tim CallanETSI is preparing to release specifications for eIDAS 2.0. One controversial aspect of this new standard is that it limits browsers' ability to determine their own trusted roots. In this episode we explain this limitation and the concerns surrounding it.1559falsefullhttps://www.spreaker.com/episode/root-causes-342-don-t-change-your-password-for-two-years--57682774tag:soundcloud,2010:tracks/1667482446Fri, 17 Nov 2023 00:00:00 +0000Tim CallanThe CA/Browser Forum rules stipulate how often forced password changes for CA employees are to occur. They don't, however, specify a frequency at which these forced changes must occur. Rather, they set the MINIMUM time before forced password changes...683falsefullhttps://www.spreaker.com/episode/root-causes-341-the-trouble-with-security-questionnaires--57623165tag:soundcloud,2010:tracks/1664111133Mon, 13 Nov 2023 00:00:00 +0000Tim CallanThe practice of sending security questionnaires to technology vendors is exploding, and with it dysfunctional behavior is on the rise. In this episode we describe how security questionnaires are changing and the pitfalls associated with this emerging...1168falsefullhttps://www.spreaker.com/episode/root-causes-340-is-this-podcast-canadian-enough--57528301tag:soundcloud,2010:tracks/1657740411Mon, 06 Nov 2023 00:00:00 +0000Tim CallanCanada's Online Streaming Act will require internet content providers to provide a minimum percentage of content produced by Canadians or face fines. We explore this latest episode in the theme of governments attempting to control the free flow of...855falsefullhttps://www.spreaker.com/episode/root-causes-339-the-roi-of-clm--57460343tag:soundcloud,2010:tracks/1653613314Tue, 31 Oct 2023 00:00:00 +0000Tim CallanIn this episode we describe at a high level how to calculate the Total Cost of Ownership (TCO) of CLM as opposed to manual installation and management of certificates.682falsefullhttps://www.spreaker.com/episode/root-causes-338-clm-and-your-career-as-an-it-professional--57354831tag:soundcloud,2010:tracks/1647354646Mon, 23 Oct 2023 00:00:00 +0000Tim CallanIn this follow up to our episode on CLM and the IT skills gap, we now discuss how CLM matters to individual IT professionals and can help progress careers and improve work life.1160falsefullhttps://www.spreaker.com/episode/root-causes-337-clm-and-the-it-skills-gap--57183213tag:soundcloud,2010:tracks/1636843149Tue, 10 Oct 2023 00:00:00 +0000Tim CallanFor decades industry has had more need for skilled IT employees than the workforce could provide. In this episode we discuss how Certificate Lifecycle Management and certificate automation can help mitigate the challenges posed by the IT skills gap.1235falsefullhttps://www.spreaker.com/episode/root-causes-336-digitally-signing-images-on-cameras--57051179tag:soundcloud,2010:tracks/1631756766Tue, 03 Oct 2023 00:00:00 +0000Tim CallanA recent press release discusses efforts of camera manufacturers and the digital imagery supply chain to create an ecosystem for digitally signed images. We describe what such an ecosystem would do, where it could do in the future, and the advantages...853falsefullhttps://www.spreaker.com/episode/root-causes-335-when-mfa-is-not-mfa--56995967tag:soundcloud,2010:tracks/1628679435Fri, 29 Sep 2023 00:00:00 +0000Tim CallanIn this episode we describe a social engineering attack to steal a one-time password (OTP) to enable unauthorized access. This incident further exploited a cloud backup feature to extend the scope of the breach. We explain.590falsefullhttps://www.spreaker.com/episode/root-causes-334-what-is-attestation-on-the-web--56962851tag:soundcloud,2010:tracks/1626863355Tue, 26 Sep 2023 00:00:00 +0000Tim CallanMost people hate dealing with CAPTCHA, but it offers great benefits for web site operators. In this episode we discuss alternatives to CAPTCHA, how they work, and their pros and cons. Plus, the Get-Off-My-Lawn! browser returns.1083falsefullhttps://www.spreaker.com/episode/root-causes-333-intel-side-channel-attack-steals-private-keys--56883244tag:soundcloud,2010:tracks/1621729950Wed, 20 Sep 2023 00:00:00 +0000Tim CallanA newly revealed side channel attack can capture AES encryption keys from Intel chips. We explain this significant and powerful attack.1015falsefullhttps://www.spreaker.com/episode/root-causes-332-acoustic-ai-based-key-logging-attack--56815023tag:soundcloud,2010:tracks/1617440298Thu, 14 Sep 2023 00:00:00 +0000Tim CallanResearchers have built an AI model that can interpret keystrokes based on the sound of keyboard use over a phone or video call. Among other things, this technique can be used to steal passwords when the sound of logging in can be overheard. Join us...636falsefullhttps://www.spreaker.com/episode/root-causes-331-microsoft-restores-trust-to-verisign-code-signing-root--56790049tag:soundcloud,2010:tracks/1615552317Wed, 13 Sep 2023 00:00:00 +0000Tim CallanRecent erroneous behavior for certain applications on Windows has drawn attention to the Microsoft trusted root store. It turns out that Microsoft removed - and then re-added - a legacy VeriSign root in its trusted roots list. We give you the...853falsefullhttps://www.spreaker.com/episode/root-causes-330-end-to-end-pqc-in-use-today--56702636tag:soundcloud,2010:tracks/1609150458Tue, 05 Sep 2023 00:00:00 +0000Tim CallanOur hosts are joined by IronCap CEO Andrew Cheung as he discusses commercially available PQC solutions today, including VPN, email, and crypto currency.1303falsefullhttps://www.spreaker.com/episode/root-causes-329-what-is-messaging-layer-security--56629744tag:soundcloud,2010:tracks/1603819845Tue, 29 Aug 2023 00:00:00 +0000Tim CallanThe recently published Messaging Layer Security (MLS) protocol establishes key exchange protocols for participants in a simultaneous communication session for three or more participants. We explain its significance and possible futures for this standard.658falsefullhttps://www.spreaker.com/episode/root-causes-328-what-is-the-debian-weak-key-flaw--56569685tag:soundcloud,2010:tracks/1599597372Wed, 23 Aug 2023 00:00:00 +0000Tim CallanIn 2008 the world of SSL was shocked by the discovery of a flaw in a popular operating system that limited the total set of possible private keys on this OS to about 32,000. We explain what happened, industry response, and its consequences.419falsefullhttps://www.spreaker.com/episode/root-causes-327-what-is-multi-perspective-domain-validation--56512346tag:soundcloud,2010:tracks/1596047181Fri, 18 Aug 2023 00:00:00 +0000Tim CallanIn this episode we explain Border Gateway Protocol (BGP) attacks and how multi-perspective domain validation (MPDV, also known as multi-vantage point domain validation) can defeat them.1016falsefullhttps://www.spreaker.com/episode/root-causes-326-the-difference-between-ml-and-mil--56479515tag:soundcloud,2010:tracks/1593936705Tue, 15 Aug 2023 00:00:00 +0000Tim CallanA recent Financial Times article reveals that mistyped email addresses aimed at the US military frequently are sent to email addresses in Mali instead, to the tune of hundreds of thousands per year. Some of this includes sensitive military content.699falsefullhttps://www.spreaker.com/episode/root-causes-325-certificate-error-causes-sharepoint-outage--56445117tag:soundcloud,2010:tracks/1590862407Fri, 11 Aug 2023 00:00:00 +0000Tim CallanA recent outage in Microsoft Sharepoint was caused by an error in certificate installation. We explain what happened and the lessons to be learned.579falsefullhttps://www.spreaker.com/episode/root-causes-324-apple-vs-new-uk-surveillance-bill--56393369tag:soundcloud,2010:tracks/1585817747Mon, 07 Aug 2023 00:00:00 +0000Tim CallanThe battle between government and encryption continues. The UK is attempting to build secret back doors into end-to-end encrypted services. In response, Apple has threatened to remove Apple services from the UK, including FaceTime and iMessage.939falsefullhttps://www.spreaker.com/episode/root-causes-323-update-on-microsoft-key-compromise--56356806tag:soundcloud,2010:tracks/1581989575Wed, 02 Aug 2023 00:00:00 +0000Tim CallanIn this follow up to our episode 320, we describe Microsoft's actions to mitigate this attack and explain new understanding that shows its impact to be broader than originally thought. Anyone using the Microsoft stack needs to understand this new threat.735falsefullhttps://www.spreaker.com/episode/root-causes-322-rip-kevin-mitnick--56325698tag:soundcloud,2010:tracks/1579312471Mon, 31 Jul 2023 00:00:00 +0000Tim CallanIn July famous security researcher Kevin Mitnick passed away. We briefly pay tribute to Kevin and talk about his contributions to white hat hacking as a practice.352falsefullhttps://www.spreaker.com/episode/root-causes-321-cabf-moratorium-on-new-certificate-consumer-members--56249471tag:soundcloud,2010:tracks/1575915868Thu, 27 Jul 2023 00:00:00 +0000Tim CallanThe CA/Browser Forum recently passed a temporary moratorium on new members of the Certificate Consumer class. We explain how Certificate Consumers have been admittted in the past and the pros and cons of creating stricter rules for Certificate Consumers.939falsefullhttps://www.spreaker.com/episode/root-causes-320-microsoft-signed-root-kit-attack--56199927tag:soundcloud,2010:tracks/1573320337Mon, 24 Jul 2023 00:00:00 +0000Tim CallanA new root kit attack in the wild is code signed by a Microsoft certificate. We explain kernel-level attacks, how powerful they are, and how this attack occurred.663falsefullhttps://www.spreaker.com/episode/root-causes-319-eu-digital-wallets--56177258tag:soundcloud,2010:tracks/1571229199Fri, 21 Jul 2023 00:00:00 +0000Tim CallanA new agreement mandates that European countries will make digital wallets available to their citizens in 2024. We explain what's coming and some of its implications.1221falsefullhttps://www.spreaker.com/episode/root-causes-318-what-is-acme-renewal-information-ari--56139908tag:soundcloud,2010:tracks/1568302042Tue, 18 Jul 2023 00:00:00 +0000Tim CallanACME is a functional and widely supported protocol for certificate provisioning and installation. A new extension to the protocol will help automate renewals. In this episode we explain ACME Renewal Information (ARI).609falsefullhttps://www.spreaker.com/episode/root-causes-317-new-automotive-can-bus-attacks-demand-pki--56090232tag:soundcloud,2010:tracks/1564140772Thu, 13 Jul 2023 00:00:00 +0000Tim CallanIn this episode we describe how physically accessing the CAN bus wires in a modern automobile can allow a thief to take over key fob functionality to unlock the doors, start the engine, and ultimately steal the vehicle. We explain how PKI can defeat...1221falsefullhttps://www.spreaker.com/episode/root-causes-316-squarespace-acquires-google-domains--56062288tag:soundcloud,2010:tracks/1561888303Tue, 11 Jul 2023 00:00:00 +0000Tim CallanSquareSpace recently acquired Google's domain registry business. We discuss what this move says about large technology trends.774falsefullhttps://www.spreaker.com/episode/root-causes-315-will-the-sec-sue-solarwinds-executives--56028794tag:soundcloud,2010:tracks/1558516069Fri, 07 Jul 2023 00:00:00 +0000Tim CallanThe SEC has sent "Wells notices" to two senior executives from SolarWinds, with regard to the 2019 supply chain attack. In this episode we explain these notices and their implication.940falsefullhttps://www.spreaker.com/episode/root-causes-314-ai-based-deepfakes-in-real-crimes--56002932tag:soundcloud,2010:tracks/1556637772Wed, 05 Jul 2023 00:00:00 +0000Tim CallanWe have spoken in previous episodes about the potential for deepfakes in real-world crimes. In this episode we discuss a variety of real-world attacks in which deepfakes have played a role. These include fake kidnapping, "sextortion," and a range of...1576falsefullhttps://www.spreaker.com/episode/root-causes-313-ssl-revocation-reason-codes--54841853tag:soundcloud,2010:tracks/1548273106Thu, 22 Jun 2023 00:00:00 +0000Tim CallanIn 2022 Mozilla added a root program requirement that CAs include Reason Codes when revoking public TLS certificates. In this episode we explain the reason codes, along with some explicitly forbidden reason codes, and go into the backstory behind...964falsefullhttps://www.spreaker.com/episode/root-causes-312-you-shouldn-t-roll-your-own-crypto--54553611tag:soundcloud,2010:tracks/1545549694Tue, 20 Jun 2023 00:00:00 +0000Tim CallanDon't roll your own crypto. In this episode we describe the findings from 2021 research that investigating the root causes of problems in cryptographic systems. The results may surprise you.895falsefullhttps://www.spreaker.com/episode/root-causes-311-what-is-ccadb--54464817tag:soundcloud,2010:tracks/1542373918Fri, 16 Jun 2023 00:00:00 +0000Tim CallanWe describe CCADB, the Common CA Database. We explain the role of CCADB in the WebPKI and how this role is evolving.834falsefullhttps://www.spreaker.com/episode/root-causes-310-another-ai-episode--54358599tag:soundcloud,2010:tracks/1538948491Tue, 13 Jun 2023 00:00:00 +0000Tim CallanIn this episode we continue to explore the capabilities of AI to replicate known people in deep fakes with AI-generated content.1515falsefullhttps://www.spreaker.com/episode/root-causes-309-what-is-key-attestation-for-code-signing--54140676tag:soundcloud,2010:tracks/1534284790Thu, 08 Jun 2023 00:00:00 +0000Tim CallanOn June 1, 2023 new rules for delivery of code signing certificates went into effect, requiring the certificate be delivered by secure HSM. In addition to shipping a token by mail, certificates can be electronically delivered to Subscriber-owned...678falsefullhttps://www.spreaker.com/episode/root-causes-308-e-tugra-root-deprecation--54104931tag:soundcloud,2010:tracks/1531662517Mon, 05 Jun 2023 00:00:00 +0000Tim CallanFor the second time in under twelve months, a major browser is deprecating a CA's public trust. This time it's E-Tugra. Learn about the concerns raised about this CA, investigation of these concerns, and the ultimate deprecation decision.1078falsefullhttps://www.spreaker.com/episode/root-causes-307-ot-red-teaming-leads-to-malware-attack--54055514tag:soundcloud,2010:tracks/1526999656Wed, 31 May 2023 00:00:00 +0000Tim CallanIn this episode we describe how tools from operational technology red team exercises are being repurposed for malware attacks.815falsefullhttps://www.spreaker.com/episode/root-causes-306-certificate-transparency-logs-and-privacy--54010022tag:soundcloud,2010:tracks/1523387233Fri, 26 May 2023 00:00:00 +0000Tim CallanCertificate Transparency (CT) logs do a lot of good for the WebPKI. They also, however, carry with them some privacy concerns. In this episode we explain those concerns.807falsefullhttps://www.spreaker.com/episode/root-causes-305-the-fifth-pillar-of-certificate-lifecycle-management--53985962tag:soundcloud,2010:tracks/1521513139Tue, 23 May 2023 00:00:00 +0000Tim CallanIn our episode 143 we introduced the Four Pillars of CLM. Now, two years later, we introduce a fifth pillar of CLM.823falsefullhttps://www.spreaker.com/episode/root-causes-304-your-90-day-ssl-certificates-checklist--53933034tag:soundcloud,2010:tracks/1517870395Thu, 18 May 2023 00:00:00 +0000Tim Callan90-day maximum term for SSL certificates is coming. In this episode expert guest Henry Lam details his four-point checklist for preparing enterprises for these shorter-lived certificates.825falsefullhttps://www.spreaker.com/episode/root-causes-303-a-return-to-chrome-and-the-address-bar--53894163tag:soundcloud,2010:tracks/1515519550Tue, 16 May 2023 00:00:00 +0000Tim CallanIn our recent episode 300 we discussed Chrome's upcoming removal of the lock icon from its interface. In this follow up, we catch the listener up on Chrome's longstanding program to minimize the URL in its interface, even to the point of contemplating...1150falsefullhttps://www.spreaker.com/episode/root-causes-302-intel-secure-boot-private-key-leak--53839298tag:soundcloud,2010:tracks/1513014721Fri, 12 May 2023 00:00:00 +0000Tim CallanResulting from a recent ransomware attack, a private key from Intel has been exposed, affecting more than a hundred OEM components and an unknown number of end user products. We explain what happened and its possible implications.753falsefullhttps://www.spreaker.com/episode/root-causes-301-the-difference-between-certificate-automation-and-clm--53794082tag:soundcloud,2010:tracks/1510343599Tue, 09 May 2023 00:00:00 +0000Tim CallanThis podcast frequently discusses the concepts of certificate automation and Certificate Lifecycle Management (CLM). In this episode we discuss how CLM does not always entail automation and vice versa -- along with where this distinction occurs and...896falsefullhttps://www.spreaker.com/episode/root-causes-300-chrome-eliminates-the-lock-icon--53752950tag:soundcloud,2010:tracks/1507288045Thu, 04 May 2023 00:00:00 +0000Tim CallanGoogle Chrome has announced that it will eliminate the lock icon in September. We explain what Google will be doing, its stated rationale, and the pros and cons of this decision.1120falsefullhttps://www.spreaker.com/episode/root-causes-299-2023-rsa-recap--53720773tag:soundcloud,2010:tracks/1504926001Tue, 02 May 2023 00:00:00 +0000Tim CallanThe 2023 RSA Conference just concluded. This week Tim recaps what he saw at the show and how it reflects on security industry trends. Our hosts discuss Zero Trust, PQC, blockchain, artificial intelligence, post-COVID tradeshow behavior, and more.1868falsefullhttps://www.spreaker.com/episode/root-causes-298-moving-forward-together-promoting-automation--53681158tag:soundcloud,2010:tracks/1502395072Fri, 28 Apr 2023 00:00:00 +0000Tim CallanThe Google Chrome root store has communicated its plans for promoting automation. In this episode we explain Chrome's public plans for this initiative, which is anchored around ACME.749falsefullhttps://www.spreaker.com/episode/root-causes-297-certificate-expiration-creates-starlink-outage--53653500tag:soundcloud,2010:tracks/1500747997Wed, 26 Apr 2023 00:00:00 +0000Tim CallanA recent outage in the Starlink internet service was caused by an unexpected certificate expiration. We discuss this ongoing problem and how 90-day maximum certificate term will exacerbate it.597falsefullhttps://www.spreaker.com/episode/root-causes-296-should-we-or-must-we--53609547tag:soundcloud,2010:tracks/1497807655Fri, 21 Apr 2023 00:00:00 +0000Tim CallanThe CA/Browser Forum guidelines contain many prescribed requirements, with language containing the word SHOULD or MUST. In this episode we explain the specifying power of these two words, why they are used, and what they signal about the intent behind...758falsefullhttps://www.spreaker.com/episode/root-causes-295-genesis-criminal-marketplace-taken-down--53565064tag:soundcloud,2010:tracks/1494911086Mon, 17 Apr 2023 00:00:00 +0000Tim CallanA large, public criminal marketplace for stolen logins and other information was rolled up by law enforcement across seventeen countries. Genesis Marketplace offered not only traditional login credentials but also associated data needed to defeat MFA.665falsefullhttps://www.spreaker.com/episode/root-causes-294-root-causes-honored-by-webby-awards--53527332tag:soundcloud,2010:tracks/1491689812Thu, 13 Apr 2023 00:00:00 +0000Tim CallanThe Root Causes podcast has received a Webby Honoree award. Jason and Tim briefly celebrate and discuss the challenge of operating a niche, homemade podcast while being directly compared to professionally produced podcasts on mainstream topics from...550falsefullhttps://www.spreaker.com/episode/root-causes-293-what-is-certbot--53493664tag:soundcloud,2010:tracks/1489207144Mon, 10 Apr 2023 00:00:00 +0000Tim CallanCertbot is an important part of the ACME standard. This open source tool makes it easier for many IT administrators to use ACME to automate provisioning and installation of SSL / TLS certificates.753falsefullhttps://www.spreaker.com/episode/root-causes-292-validation-data-reuse-for-90-day-certificates--53466172tag:soundcloud,2010:tracks/1486921291Thu, 06 Apr 2023 00:00:00 +0000Tim CallanAs the industry explores the expected consequences of 90-day maximum term for SSL / TLS certificates, some are wondering if the allowed validation data reuse period stands to go down also. We explain today's data reuse rules and what the evidence...921falsefullhttps://www.spreaker.com/episode/root-causes-291-clm-and-siem--53427824tag:soundcloud,2010:tracks/1484037643Mon, 03 Apr 2023 00:00:00 +0000Tim CallanWe discuss how Certificate Lifecycle Management (CLM) interacts with Security Incident and Event Management (SIEM). The certificate world is chock full of events such as renewals, revocations, admin logins, and provisioning and removal of employee...580falsefullhttps://www.spreaker.com/episode/root-causes-290-what-are-qgis-and-qiis--53396790tag:soundcloud,2010:tracks/1481509357Wed, 29 Mar 2023 00:00:00 +0000Tim CallanIn this episode we define Qualified Government Information Source (QGIS) and Qualified Independent Information Source (QIIS), which are critical to CABF-compliant organization validation. We explain how they fit into validation and the criteria for a...786falsefullhttps://www.spreaker.com/episode/root-causes-289-what-is-a-cryptographic-center-of-excellence--53355401tag:soundcloud,2010:tracks/1478675155Mon, 27 Mar 2023 00:00:00 +0000Tim CallanIn this episode we dig into an emerging idea, which is the cryptographic center of excellence. We discuss how such a center of excellence would work and the benefits it can bring to an enterprise.510falsefullhttps://www.spreaker.com/episode/root-causes-288-isara-releases-patents-on-hybrid-certificates--53306891tag:soundcloud,2010:tracks/1475542822Thu, 23 Mar 2023 00:00:00 +0000Tim CallanIn this episode we are joined by Atsushi Yamada, CEO of ISARA. He explains how ISARA has put its patents on hybrid certificates into the public domain and why. We explain the role of hybrid certificates in PQC and ongoing crypto agility.740falsefullhttps://www.spreaker.com/episode/root-causes-287-godaddy-private-key-breach--53277879tag:soundcloud,2010:tracks/1473894910Mon, 20 Mar 2023 00:00:00 +0000Tim CallanIn this episode we describe an incident in which a GoDaddy breach exposed customer private keys. We explain the expectations surrounding private key exposure and get into the interesting question of when an incident is or is not part of a large...828falsefullhttps://www.spreaker.com/episode/root-causes-286-pki-and-pqc-in-new-white-house-cybersecurity-initiative--53224635tag:soundcloud,2010:tracks/1470216301Thu, 16 Mar 2023 00:00:00 +0000Tim CallanA new White House cybersecurity initiative specifically calls out digital identity and post quantum cryptography (PQC) among its focal areas. We discuss what it says and the potential implications.605falsefullhttps://www.spreaker.com/episode/root-causes-285-can-chatgpt-write-malware--53195020tag:soundcloud,2010:tracks/1468666618Tue, 14 Mar 2023 00:00:00 +0000Tim CallanIn our ongoing exploration of the security implications of AI, in this episode we examine the suitability of ChatGPT as a malware-writing tool and possible future directions for AI in software creation.970falsefullhttps://www.spreaker.com/episode/root-causes-284-90-day-ssl-certificates-are-on-the-way--53160843tag:soundcloud,2010:tracks/1466102515Fri, 10 Mar 2023 00:00:00 +0000Tim CallanThe Google Chrome root program recently announced its intention to reduce the maximum term for public SSL certificates to 90 days. In this episode we explain this announcement and its implications and speculate on timing for this reduction.1435falsefullhttps://www.spreaker.com/episode/root-causes-283-google-optional-ocsp-proposal-clarified--53112429tag:soundcloud,2010:tracks/1462715416Mon, 06 Mar 2023 00:00:00 +0000Tim CallanIn our episode 281 we reported on Google's proposal for optional OCSP. In this episode we correct some of our earlier reporting in that episode, including the use of CRL and the removal of any revocation requirement for SSL certificates of not more...679falsefullhttps://www.spreaker.com/episode/root-causes-282-hsms-and-post-quantum-cryptography--53073341tag:soundcloud,2010:tracks/1459740211Thu, 02 Mar 2023 00:00:00 +0000Tim CallanRepeat guest Bruno Couillard of Crypto4A joins us to explain where Hardware Secure Modules (HSMs) fit into the world of PQC. We discuss the issues surrounding how HSMs will work with post quantum algorithms and hybrid certificates and the process (and...1717falsefullhttps://www.spreaker.com/episode/root-causes-281-google-proposes-optional-ocsp--52927564tag:soundcloud,2010:tracks/1457069434Sun, 26 Feb 2023 00:00:00 +0000Tim CallanIn response to concerns about OCSP and privacy, Google has proposed removing the requirement for OCSP revocation checking for public SSL certificates meeting certain specific conditions. In this episode we go into the details of this proposal.1583falsefullhttps://www.spreaker.com/episode/root-causes-280-did-an-ai-break-crystals-kyber--52926729tag:soundcloud,2010:tracks/1455102184Fri, 24 Feb 2023 00:00:00 +0000Tim CallanRecent news reports might suggest that an AI-enhanced side attack has defeated the CRYSTALS-Kyber PQC algorithm. In this episode we clarify that Kyber has not been defeated to date and exactly what did occur. We define side channel attack, discuss...1209falsefullhttps://www.spreaker.com/episode/root-causes-279-chatgpt-watermarking--52927542tag:soundcloud,2010:tracks/1451544178Sun, 19 Feb 2023 00:00:00 +0000Tim CallanChatGPT presents the potential problem of ChatGPT content being used and attributed to another source, such as a professional writer or a student. In this episode we discuss the idea of "watermarking" ChatGPT content, including stenography,...955falsefullhttps://www.spreaker.com/episode/root-causes-278-microsoft-on-certificates-and-fido--52926764tag:soundcloud,2010:tracks/1449414250Fri, 17 Feb 2023 00:00:00 +0000Tim CallanRecent public discussion of FIDO and digital certificates reveal details of Microsoft's approach to consumer digital authentication. We discuss secure elements, Windows Hello, and the differences between B2C, B2B, and B2E.678falsefullhttps://www.spreaker.com/episode/root-causes-277-privacy-sandbox--52926609tag:soundcloud,2010:tracks/1446183160Mon, 13 Feb 2023 00:00:00 +0000Tim CallanIn the latest continuation of the effort to create better protections for consumer privacy while still enabling targeted advertising, Google has announced the Privacy Sandbox. In this episode we describe this latest foray, including concepts like...914falsefullhttps://www.spreaker.com/episode/root-causes-276-chatgpt-and-identity-reputation--52926761tag:soundcloud,2010:tracks/1443348508Thu, 09 Feb 2023 00:00:00 +0000Tim CallanChatGPT and similar AI tools are dominating the public's mind these days. In this episode we discuss the potential for people to attempt to use ChatGPT as a source of reputational analysis, KYC, and other information about individuals, companies, and...486falsefullhttps://www.spreaker.com/episode/root-causes-275-no-fly-list-stolen--52928406tag:soundcloud,2010:tracks/1441249732Mon, 06 Feb 2023 00:00:00 +0000Tim CallanIn a recently revealed security breach, an attacker gained a copy of the full 2019 TSA No Fly list, including subject PII. This breach was enabled by failures in digital identity and encryption. Join us in unpacking what happened and the lessons to be...508falsefullhttps://www.spreaker.com/episode/root-causes-274-new-quantum-readiness-law--52927560tag:soundcloud,2010:tracks/1439270110Fri, 03 Feb 2023 00:00:00 +0000Tim CallanThe U.S. government has a new law requiring that government agencies create plans for migrating to post-quantum cryptography in response to impending threats from quantum computers. In this episode we are joined by guest Bruno Couillard of Crypto4A to...834falsefullhttps://www.spreaker.com/episode/root-causes-273-a-deep-dive-on-ca-agnostic--52928400tag:soundcloud,2010:tracks/1436112121Mon, 30 Jan 2023 00:00:00 +0000Tim CallanThe industry is seeing more and more attention spent on the idea of CA agnosticism. As with any buzzy technology term, it can be used to mean a variety of things. Join us as we catalog the various ways a Certificate Lifecycle Management (CLM) system...1278falsefullhttps://www.spreaker.com/episode/root-causes-272-ocsp-s-privacy-problem--52926576tag:soundcloud,2010:tracks/1433929948Fri, 27 Jan 2023 00:00:00 +0000Tim CallanConcerns recently have been raised about OCSP real-time certificate checking and its potential to violate privacy. In this episode we unpack these concerns and discuss the alternatives to OCSP.736falsefullhttps://www.spreaker.com/episode/root-causes-271-a-whole-fleet-of-identity-based-automotive-hacks--52925895tag:soundcloud,2010:tracks/1430990041Mon, 23 Jan 2023 00:00:00 +0000Tim CallanA white hat security researcher recently revealed a large number of identity-based vulnerabilities across many automotive manufacturers. In this episode we explain how a group of white hats exploited these manufacturers' dependence on non-secret...1341falsefullhttps://www.spreaker.com/episode/root-causes-270-what-is-the-difference-between-kem-and-pke--52925902tag:soundcloud,2010:tracks/1428793909Fri, 20 Jan 2023 00:00:00 +0000Tim CallanOne of the little known changes that has come to the world of TLS is that the secret handshake and key exchange updated from Public Key Exchange (PKE) to Key Encapsulation Methods (KEM). In this episode we explain the difference between the two...715falsefullhttps://www.spreaker.com/episode/root-causes-269-did-a-patent-dispute-nearly-derail-post-quantum-cryptography--52926536tag:soundcloud,2010:tracks/1425686413Mon, 16 Jan 2023 00:00:00 +0000Tim CallanOn July 5, 2022 NIST announced its Round 3 PQC winners. What most people don't realize is that same day, the interested parties cleared a patent dispute that had the potential to prevent several of the winning primitives from moving forward. Join us...592falsefullhttps://www.spreaker.com/episode/root-causes-268-wafs-subverted-by-json-bypass--52926689tag:soundcloud,2010:tracks/1422711448Thu, 12 Jan 2023 00:00:00 +0000Tim CallanIn this episode we discuss rising attacks that overcome the protections of Web Application Firewalls (WAF). We explain these attacks, why this bypass might effective against you even if think it doesn't, and what you should do to ensure you're safe.533falsefullhttps://www.spreaker.com/episode/root-causes-267-can-quantum-computers-break-rsa-today--52927150tag:soundcloud,2010:tracks/1420009558Mon, 09 Jan 2023 00:00:00 +0000Tim CallanMuch has been made of Schor's algorithm and the inevitable defeat of RSA using quantum computers. But a new research paper suggests a quantum computer may be applied to the problem in a fundamentally different way, hastening RSA's demise beyond even...1372falsefullhttps://www.spreaker.com/episode/root-causes-266-end-to-end-encryption-in-the-apple-technology-stack--52925903tag:soundcloud,2010:tracks/1416429175Wed, 04 Jan 2023 00:00:00 +0000Tim CallanRecent announcements from Apple lay out a set of expansions in the scope and capability of encryption throughout the Apple ecosystem. In this episode we detail the announced changes and some of their implications.1077falsefullhttps://www.spreaker.com/episode/root-causes-265-a-banner-year-for-post-quantum-cryptography--52925849tag:soundcloud,2010:tracks/1411919035Wed, 28 Dec 2022 00:00:00 +0000Tim Callan2022 was post-quantum cryptography's biggest year so far. Our hosts are joined by guest Bruno Couillard, CEO and CTO of Crypto4A. We go over many developments in PQC, including the announcement of the NIST round 3 winners, the defeat of several late...1993falsefullhttps://www.spreaker.com/episode/root-causes-264-crypto-agility-for-2023--52927161tag:soundcloud,2010:tracks/1409087032Fri, 23 Dec 2022 00:00:00 +0000Tim CallanWe define the important needs and initiatives that are changing the crypto agility landscape. We discuss topics including CA independence, cryptography in public clouds, post-quantum cryptography (PQC) agility, hybrid certificates, and FIDO 2/WebAuthn.1143falsefullhttps://www.spreaker.com/episode/root-causes-263-secure-connection-methods-roundup--52927553tag:soundcloud,2010:tracks/1406776609Tue, 20 Dec 2022 00:00:00 +0000Tim CallanIn this episode we discuss the three methods a user might choose for secure remote communications: VPN, SSH, and TOR. For each we discuss the reasons you might choose them and the pros and cons of each.1533falsefullhttps://www.spreaker.com/episode/root-causes-262-the-continuing-erosion-of-online-identity--52925878tag:soundcloud,2010:tracks/1402889653Wed, 14 Dec 2022 00:00:00 +0000Tim CallanIn one of our 2022 wrap up episodes, we look back at the continued erosion of the idea of reliable online identity throughout the year. We discuss the rise of deep fakes, celebrity phishing, voice biometrics, AI-generated art, trust models, and the...1378falsefullhttps://www.spreaker.com/episode/root-causes-261-why-i-don-t-say-spoof--52927182tag:soundcloud,2010:tracks/1401876283Mon, 12 Dec 2022 00:00:00 +0000Tim CallanThe word spoof is a security industry term used in the context of social engineering attacks. In this episode we explore the word's connotations in different walks of life and why its connotations may not serve us well when applied to security concerns.608falsefullhttps://www.spreaker.com/episode/root-causes-260-ca-trustcor-deprecated--52927149tag:soundcloud,2010:tracks/1398950962Thu, 08 Dec 2022 00:00:00 +0000Tim CallanPublic CA TrustCor has had its roots deprecated by Microsoft and Mozilla, following a public dialog about TrustCor's suitability as a public CA. This entire investigation was prompted by a Washington Post article articulating a series of connections...1812falsefullhttps://www.spreaker.com/episode/root-causes-259-what-went-wrong-with-the-twitter-blue-check-marks--52925809tag:soundcloud,2010:tracks/1393626763Wed, 30 Nov 2022 00:00:00 +0000Tim CallanThe Twitter authenticated identity blue check marks made a big splash and then quickly went away. In this episode we explore the intent of these check marks and why they failed. In particular, we detail the challenges involved in authenticating and...857falsefullhttps://www.spreaker.com/episode/root-causes-258-new-s-mime-baseline-requirements-ratified--52925916tag:soundcloud,2010:tracks/1388255815Mon, 21 Nov 2022 00:00:00 +0000Tim CallanThe CA/Browser Forum has passed new Baseline Requirements for S/MIME certificates, in effect late 2023. In this episode we explain the broad stipulations of the new S/MIME BRs, including the multiple available levels of authentication and use case...1025falsefullhttps://www.spreaker.com/episode/root-causes-257-ftx-crypto-exchange-collapses--52928412tag:soundcloud,2010:tracks/1385958775Thu, 17 Nov 2022 00:00:00 +0000Tim Callan"If you don't hold the keys, you don't hold the cheese." Crypto exchange giant FTX recently collapsed, causing ripples through the cryptocurrency world. In this episode we focus on the cryptographic difference between cryptocurrency exchanges and...685falsefullhttps://www.spreaker.com/episode/root-causes-256-what-is-harvest-and-decrypt--52927198tag:soundcloud,2010:tracks/1384433785Wed, 16 Nov 2022 00:00:00 +0000Tim CallanAs we prepare for the reality of quantum computers breaking RSA and ECC, a keenly important concept to understand is "Harvest and Decrypt." The practical impact of Harvest and Decrypt is that for secrets with a reasonable lifespan, the quantum...1173falsefullhttps://www.spreaker.com/episode/root-causes-255-what-is-a-privacy-browser--52927566tag:soundcloud,2010:tracks/1380955333Fri, 11 Nov 2022 15:02:20 +0000Tim CallanIn this episode we describe privacy browsers, which quite simply are browsers designed to pay special attention to the user's privacy, including some of the strategies they use to protect privacy and the pros and cons of this approach.1368falsefullhttps://www.spreaker.com/episode/root-causes-254-toyota-symmetric-key-exposed-on-github--52926630tag:soundcloud,2010:tracks/1378819801Tue, 08 Nov 2022 00:00:00 +0000Tim CallanIn a recently exposed error, key material for a popular automobile manufacturer's PKI has been discovered on GitHub, resulting in exposure of sensitive information. In this episode we explain the dual errors that led to this breach.654falsefullhttps://www.spreaker.com/episode/root-causes-253-openssl-vulnerability-explained--52927534tag:soundcloud,2010:tracks/1376617399Fri, 04 Nov 2022 00:00:00 +0000Tim CallanLast week the OpenSSL project announced an upcoming critical patch, leading to a great deal of speculation about this flaw and its implications for SSL certificates. We explain what the flaw was, what you should do, and why it is that certificates...558falsefullhttps://www.spreaker.com/episode/root-causes-252-sidestepping-microsoft-email-encryption--52925921tag:soundcloud,2010:tracks/1374493801Sun, 30 Oct 2022 00:00:00 +0000Tim CallanA recently revealed vulnerability in Microsoft Exchange encryption can be used potentially to break the encryption on stored emails. In this episode we explain ECB (Electronic Code Book encryption and how this attack can occur.852falsefullhttps://www.spreaker.com/episode/root-causes-251-what-s-next-for-the-nist-pqc-primitives--52926713tag:soundcloud,2010:tracks/1372032334Thu, 27 Oct 2022 00:00:00 +0000Tim CallanNIST has announced its new post-quantum cryptography primitives. So now what? In this episode we discuss the next steps required by the technology industry for widespread adoption of these algorithms and what the enterprise can do starting today to...1246falsefullhttps://www.spreaker.com/episode/root-causes-250-250-episodes-of-root-causes--52928408tag:soundcloud,2010:tracks/1370410666Wed, 26 Oct 2022 00:00:00 +0000Tim CallanIt's Root Causes episode 250! In this episode Tim and Jason indulge themselves in podcasting about podcasting. Hear about setting up a podcast, choosing topics, why we don't rehearse, why we have so few guests, and how we reacted the first time...1594falsefullhttps://www.spreaker.com/episode/root-causes-249-what-is-mfa-exhaustion--52928424tag:soundcloud,2010:tracks/1367719174Fri, 21 Oct 2022 00:00:00 +0000Tim CallanRecent months have seen several high profile attacks that were enabled by defeating the MFA accompanying user name and password login. In this episode we explain the concept of MFA fatigue and why it is an enabler for these attacks.624falsefullhttps://www.spreaker.com/episode/root-causes-248-azure-code-signing-announced--52926631tag:soundcloud,2010:tracks/1365415801Tue, 18 Oct 2022 00:00:00 +0000Tim CallanMicrosoft has announced the upcoming availability of a Microsoft-run code signing solution inside the Azure platform. We explain this approach's advantages and what to expect from it.567falsefullhttps://www.spreaker.com/episode/root-causes-247-uber-breach-unpacked--52925732tag:soundcloud,2010:tracks/1362421999Thu, 13 Oct 2022 00:00:00 +0000Tim CallanA recent high-profile breach of Uber's systems led to widespread data loss. Join our experts as we unpack the specifics of how this attack came about.722falsefullhttps://www.spreaker.com/episode/root-causes-246-google-chrome-root-program-announced--52926625tag:soundcloud,2010:tracks/1356774772Mon, 03 Oct 2022 00:00:00 +0000Tim CallanGoogle Chrome recently announced the formation of its trusted root program. It may be surprising to learn that the world's most popular browser has existed for more than a decade without its own root program. In this episode we explain why that is the...721falsefullhttps://www.spreaker.com/episode/root-causes-245-one-time-passcode-as-a-liability--52925957tag:soundcloud,2010:tracks/1353681415Thu, 29 Sep 2022 00:00:00 +0000Tim CallanA recent article from Brian Krebs advances the idea that using OTP MFA may actually be a liability to security. In this episode we explain the reasoning behind this characterization.611falsefullhttps://www.spreaker.com/episode/root-causes-244-pwc-survey-reports-cyber-security-as-biggest-risk-to-companies--52928414tag:soundcloud,2010:tracks/1351414354Mon, 26 Sep 2022 00:00:00 +0000Tim CallanA recent survey from PwC reports that cyber threats are no longer solely the domain on the CISO but instead have become every senior executive's concern. We dive deep into these survey results and talk about they correlate with our own experiences,...940falsefullhttps://www.spreaker.com/episode/root-causes-243-which-came-first-the-brs-or-the-evgs--52926725tag:soundcloud,2010:tracks/1347656671Tue, 20 Sep 2022 00:00:00 +0000Tim CallanMany people don't realize that the CA/Browser Forum's Baseline Requirements actually came LATER THAN the Extended Validation Guidelines. In this episode we explain how this seemly backward turn of events came about and what it says about how online...633falsefullhttps://www.spreaker.com/episode/root-causes-242-let-s-encrypt-founder-peter-eckersley-passes--52927220tag:soundcloud,2010:tracks/1345249654Fri, 16 Sep 2022 18:47:20 +0000Tim CallanElectronic Frontier Foundation member and Let's Encrypt co-founder Peter Eckersley passed away recently at a young age. In this episode we pay respect to Peter's memory and his many contributions, including ACME, Certbot, and Let's Encrypt.425falsefullhttps://www.spreaker.com/episode/root-causes-241-is-china-outspending-the-west-in-quantum-computing--52927229tag:soundcloud,2010:tracks/1342572652Mon, 12 Sep 2022 00:00:00 +0000Tim CallanA December 2021 report appears to indicate that China as vastly outspending Western countries in quantum computing. In this episode we examine this claim, including the role of private industry as opposed to government funding, the importance of...1220falsefullhttps://www.spreaker.com/episode/root-causes-240-hyundai-production-private-key-found-in-how-to-manual--52927472tag:soundcloud,2010:tracks/1339575196Tue, 06 Sep 2022 00:00:00 +0000Tim CallanA white hat researcher recently defeated a production automobile's PKI by searching for the private key on Google. Join us as we describe the implementation error making this possible and how it might have come about.940falsefullhttps://www.spreaker.com/episode/root-causes-239-post-quantum-cryptography-candidate-sike-defeated--52927239tag:soundcloud,2010:tracks/1333538782Sun, 28 Aug 2022 00:00:00 +0000Tim CallanNIST's round four post-quantum crypto candidate SIKE (Supersingular Isogeny Key Encapsulation) has been defeated and is now out of consideration. In this episode we explain isogeny cryptography, why NIST is seeking additional candidates, and why...1051falsefullhttps://www.spreaker.com/episode/root-causes-238-tim-s-big-phishing-adventure--52927141tag:soundcloud,2010:tracks/1324503661Mon, 15 Aug 2022 00:00:00 +0000Tim CallanIn a personally unprecedented occurrence, Tim's identity as a Sectigo executive is being used in a "waterholing" phishing scam intended to raid job seekers' bank accounts. We describe what is going on, how we found out, and the challenges in...1011falsefullhttps://www.spreaker.com/episode/root-causes-237-why-mozilla-is-so-important-to-cas--52926742tag:soundcloud,2010:tracks/1321683601Wed, 10 Aug 2022 00:00:00 +0000Tim CallanMozilla is a highly important to the world of public certificates, with influence beyond what the Firefox browser market share would suggest. In this episode we examine the historical reasons for this influence and the mechanisms that maintain that...716falsefullhttps://www.spreaker.com/episode/root-causes-236-active-directory-patch-knocks-out-non-ms-identity-consumers--52925965tag:soundcloud,2010:tracks/1318024705Thu, 04 Aug 2022 00:00:00 +0000Tim CallanA recently revealed vulnerability in Active Directory made it possible for an attacker to escalate privileges inappropriately. Microsoft's responded with a patch in May 2022, which unfortunately has forced a difficult workaround for many common...758falsefullhttps://www.spreaker.com/episode/root-causes-235-what-is-lattice-based-cryptography--52926702tag:soundcloud,2010:tracks/1312923346Tue, 26 Jul 2022 00:00:00 +0000Tim CallanThe recent winners of the NIST post-quantum cryptography contest are strongly focused on lattice-based encryption. In this episode we explain at a high level what this cryptographic approach entails and why lattice-based algorithms fared so well in...1584falsefullhttps://www.spreaker.com/episode/root-causes-234-report-from-the-2022-rsa-conference--52925930tag:soundcloud,2010:tracks/1310051782Fri, 22 Jul 2022 00:00:00 +0000Tim CallanThe RSA Security Conference is back. In this episode we talk about what happened in 2020 and how the first post-COVID RSAC compared to earlier years, along with some of the major themes this year.614falsefullhttps://www.spreaker.com/episode/root-causes-233-cisa-recommendations-for-post-quantum-crypto--52926541tag:soundcloud,2010:tracks/1304694235Tue, 12 Jul 2022 00:00:00 +0000Tim CallanIn coordination with NIST's announcement of its new post-quantum cryptographic algorithm contest winners, the Cybersecurity and Infrastructure Security Agency released a bulletin listing six key actions for IT to commence now. We read out these six...1527falsefullhttps://www.spreaker.com/episode/root-causes-232-nist-announces-post-quantum-crypto-selections--52926666tag:soundcloud,2010:tracks/1301993602Fri, 08 Jul 2022 00:00:00 +0000Tim CallanNIST has announced its winning algorithms for round 3 of its post-quantum cryptography "contest." Join us as we name the winning algorithms and why they were chosen. We discuss the continuing effort to arrive at additional algorithms, and we talk...1128falsefullhttps://www.spreaker.com/episode/root-causes-231-what-is-fido--52928432tag:soundcloud,2010:tracks/1300771300Wed, 06 Jul 2022 00:00:00 +0000Tim CallanRecent announcements about consumer passwordless authentication build on standards like FIDO and WebAuthn. In this episode we explain device-centric authentication, the FIDO Alliance, and how it all works.1451falsefullhttps://www.spreaker.com/episode/root-causes-230-what-is-apple-passkey--52926694tag:soundcloud,2010:tracks/1297458274Thu, 30 Jun 2022 00:00:00 +0000Tim CallanApple recently announced its Passkey functionality, which will allow passwordless authentication between Apple devices and supporting web services through key exchange. In this episode we discuss how this works, the user experience, the significance...955falsefullhttps://www.spreaker.com/episode/root-causes-229-browsing-collectives-and-the-80-20-rule-of-browser-privacy--52926026tag:soundcloud,2010:tracks/1283772628Wed, 08 Jun 2022 00:00:00 +0000Tim CallanIn this follow-on to our two previous podcasts, we elucidate additional potential schemes for preserving consumer privacy. We discuss data aggregation, the power of the default, decentralized blockchain identities, the death of cookies, browsing...1301falsefullhttps://www.spreaker.com/episode/root-causes-228-getting-the-floc-out-of-here--52926802tag:soundcloud,2010:tracks/1279293649Tue, 31 May 2022 00:00:00 +0000Tim CallanIn a follow-up to our recent episode on cookies and browser tracking, we discuss Google's Federated Learning of Cohorts (FLoC) initiative, why it failed as a response, and other directions the industry is looking in.862falsefullhttps://www.spreaker.com/episode/root-causes-227-let-s-talk-about-cookies--52926707tag:soundcloud,2010:tracks/1276473097Fri, 27 May 2022 00:00:00 +0000Tim CallanIn this episode we explain the fundamentals of cookies and why, despite their obvious benefits, they present troublesome privacy concerns. We discuss the many ways web users can be tracked including cross-site cookies, tracking pixels, and browser...1414falsefullhttps://www.spreaker.com/episode/root-causes-226-the-six-benefits-of-ssh-certificates--52927584tag:soundcloud,2010:tracks/1274548675Tue, 24 May 2022 00:00:00 +0000Tim CallanIn this third episode in our series on SSH keys, we identify the six main benefits of SSH certificates and how they mitigate the problems with SSH identified in earlier episodes.1289falsefullhttps://www.spreaker.com/episode/root-causes-225-the-difference-between-relying-parties-and-certificate-consumers--52928429tag:soundcloud,2010:tracks/1272236584Thu, 19 May 2022 00:00:00 +0000Tim CallanDespite the similarity in their names, in the world of digital certificates a Relying Party and a Certificate Consumer are very different things. In this episode we define the four main roles in the public trust ecosystem: CA, Subscriber, Certificate...919falsefullhttps://www.spreaker.com/episode/root-causes-224-the-five-problems-with-ssh-keys--52927572tag:soundcloud,2010:tracks/1270122652Tue, 17 May 2022 00:00:00 +0000Tim CallanIn this follow-on to our earlier episode explaining SSH keys, we discuss the five problems SSH keys present to organizations using them. And we give a peek at how to solve these problems.1156falsefullhttps://www.spreaker.com/episode/root-causes-223-ct-log-enabled-attacks-on-wordpress-sites--52928437tag:soundcloud,2010:tracks/1267828354Wed, 11 May 2022 00:00:00 +0000Tim CallanAttackers are using CT logs to identify brand new WordPress sites and install malware before upcoming security measures are in place. This attack is novel in how it exploits Certificate Transparency information to identify likely targets. In this...884falsefullhttps://www.spreaker.com/episode/root-causes-222-consolidation-and-pki-solutions--52928401tag:soundcloud,2010:tracks/1266343156Wed, 11 May 2022 00:00:00 +0000Tim CallanVendor consolidation is an important topic in IT security. As the scope and variety of threats continues to increase, we have seen a proliferation of point solutions and features, and a resulting desire to reduce that vendor footprint or at least...620falsefullhttps://www.spreaker.com/episode/root-causes-221-what-are-ssh-keys--52926033tag:soundcloud,2010:tracks/1262883439Wed, 04 May 2022 00:00:00 +0000Tim CallanSSH (Secure Shell) keys are ubiquitous for authenticated access to Linux systems. In this first of three episodes we explain what these keys are and how they're used.896falsefullhttps://www.spreaker.com/episode/root-causes-220-the-difference-between-otp-and-passwordless--52927617tag:soundcloud,2010:tracks/1261038070Mon, 02 May 2022 00:00:00 +0000Tim Callan"Passwordless" is a hot term in the industry, and as a result many technology vendors are attaching their solutions to this term. In this episode we clarify the difference between OTP services and passwordless authentication.845falsefullhttps://www.spreaker.com/episode/root-causes-219-new-quantum-cryptography-legislation-introduced--52926727tag:soundcloud,2010:tracks/1258102672Tue, 26 Apr 2022 00:00:00 +0000Tim CallanNew proposed legislation in the US House of Representatives mandates that federal agencies must begin preparation for using the new quantum resistant cryptographic algorithms selected by NIST. This represents a major development in building a quantum...730falsefullhttps://www.spreaker.com/episode/root-causes-218-pki-nomenclature-oddities--52926737tag:soundcloud,2010:tracks/1253781097Wed, 20 Apr 2022 17:47:17 +0000Tim CallanEvery technology space has its jargon. In this episode we go over some of the interesting, ambiguous, or amusing terms that are specific to the PKI and digital certificates industry.1816falsefullhttps://www.spreaker.com/episode/root-causes-217-what-s-the-deal-with-the-recent-okta-security-breach--52926055tag:soundcloud,2010:tracks/1250269009Thu, 14 Apr 2022 00:00:00 +0000Tim CallanIn March the LAPSIS$ hacking group convincingly announced a breach of Okta systems, potentially exposing Okta customers to additional compromise. Despite Okta's initial statements to the contrary, it ultimately turned out that up to 366 Okta customers...1469falsefullhttps://www.spreaker.com/episode/root-causes-216-what-is-crt-sh--52926789tag:soundcloud,2010:tracks/1248464884Sun, 10 Apr 2022 00:00:00 +0000Tim CallanOne of the foundational tools for monitoring and understanding public SSL certificates is crt.sh, created and maintained by Sectigo's own Rob Stradling. In this episode our hosts explain what crt.sh does and why it is so popular among SSL industry...650falsefullhttps://www.spreaker.com/episode/root-causes-215-passwordless-authentication-and-legacy-systems--52926080tag:soundcloud,2010:tracks/1246752205Fri, 08 Apr 2022 00:00:00 +0000Tim CallanOrganizations seeking to use passwordless authentication frequently must deal with legacy systems that cannot support this scheme. In this episode we explain why that occurs and detail the steps organizations can take to mitigate the effect of legacy...1416falsefullhttps://www.spreaker.com/episode/root-causes-214-new-duo-mfa-flaw-explained--52926811tag:soundcloud,2010:tracks/1244783002Tue, 05 Apr 2022 00:00:00 +0000Tim CallanA recent FBI warning cautions organizations about exploits based on misconfigured DUO MFA, which exploits weaknesses in Active Directory to provision credentials on DUO for malicious parties. This is an unusual story in several ways, including the...677falsefullhttps://www.spreaker.com/episode/root-causes-212-s-mime-limited-to-three-years--52927598tag:soundcloud,2010:tracks/1240117351Mon, 28 Mar 2022 00:00:00 +0000Tim CallanOn April 1 new root program requirements from Apple for S/MIME certificates go into effect, including a limitation of the allowable term to three years. This is contrary to Apple's stated intentions last year. In this episode the explain this change...642falsefullhttps://www.spreaker.com/episode/root-causes-213-600-domain-phishing-attack--52927280tag:soundcloud,2010:tracks/1241964406Mon, 28 Mar 2022 00:00:00 +0000Tim CallanIn this episode we describe a recent phishing campaign noteworthy for its scale, encompassing a total of 600 unique domains. We discuss the implications of a campaign of this scale and high level of organization.485falsefullhttps://www.spreaker.com/episode/root-causes-211-does-clm-make-wildcard-and-mdc-irrelevant--52926783tag:soundcloud,2010:tracks/1232119597Sat, 12 Mar 2022 00:00:00 +0000Tim CallanWildcard and multi-domain certificates have traditionally made administration easier for IT departments. In this episode we weigh the degree to which Certificate Lifecycle Management (CLM) renders these benefits obsolete and if these certificate types...854falsefullhttps://www.spreaker.com/episode/root-causes-210-living-off-the-land--52926090tag:soundcloud,2010:tracks/1228718440Mon, 07 Mar 2022 00:00:00 +0000Tim CallanMicrosoft has deprecated support for the popular sysadmin tool WMIC. Join our hosts as they explain the security reasons behind this development and broader lessons we can learn.393falsefullhttps://www.spreaker.com/episode/root-causes-209-one-day-deployment-of-certificate-lifecycle-management-clm-platforms--52926856tag:soundcloud,2010:tracks/1224660349Mon, 28 Feb 2022 00:00:00 +0000Tim CallanFor any Certificate Lifecycle Management platform to succeed, effective deployment is essential. Our hosts are joined by Sectigo SVP of Global Sales Jennifer Binet who describes the optimal onboarding process, step by step. Jennifer discusses adding...1234falsefullhttps://www.spreaker.com/episode/root-causes-208-automotive-information-systems-bricked-by-hd-radio-error--52927622tag:soundcloud,2010:tracks/1221810958Thu, 24 Feb 2022 17:59:42 +0000Tim CallanA major automobile manufacturer recently had a problem where its infotainment systems were permanently "bricked" by a flaw in local HD radio broadcasts. Our hosts describe what happened and explore the lessons we can learn from this incident.583falsefullhttps://www.spreaker.com/episode/root-causes-207-former-gartner-analyst-david-mahdi-jumps-on-the-playing-field--52927600tag:soundcloud,2010:tracks/1220037058Mon, 21 Feb 2022 00:00:00 +0000Tim CallanGartner analyst David Mahdi recently left the analyst space for Sectigo. In this episode he joins our hosts to explain the reasons for his optimism about digital trust, including NFTs, Web3, blockchain, PKI, and Zero Trust.1137falsefullhttps://www.spreaker.com/episode/root-causes-206-what-is-web3--52926075tag:soundcloud,2010:tracks/1215762505Sun, 13 Feb 2022 00:00:00 +0000Tim CallanWeb3 refers to the concept that online content can be attributed to specific known publishers, regardless of web site or online channel. In this episode we discuss the fundamentals of Web3, including self-signing protocols, authorization of content,...2011falsefullhttps://www.spreaker.com/episode/root-causes-205-anatomy-of-an-encrypted-peer-to-peer-mesh-network--52926709tag:soundcloud,2010:tracks/1212867211Wed, 09 Feb 2022 00:00:00 +0000Tim CallanSecure online collaboration poses logistical and technical challenges under the best of circumstances. Now imagine you have no designated IT staff, no designated hardware, a small budget, and remote participants who are not deeply technical. In this...750falsefullhttps://www.spreaker.com/episode/root-causes-204-pki-s-role-in-passwordless--52926065tag:soundcloud,2010:tracks/1209217972Wed, 02 Feb 2022 00:00:00 +0000Tim CallanIn previous episodes we have defined passwordless identity authentication. In this episode our hosts explain PKI's specific role in passwordless authentication, along the way clarifying the difference between password-masking and true passwordless...1376falsefullhttps://www.spreaker.com/episode/root-causes-203-what-is-a-credential-vault--52927273tag:soundcloud,2010:tracks/1207239178Mon, 31 Jan 2022 00:00:00 +0000Tim CallanCredential vaults are necessary for secure and functional secrets management for automated systems like DevOps or Robotic Process Automation (RPA). This episode explains how credential vaults work and details their benefits.645falsefullhttps://www.spreaker.com/episode/root-causes-202-what-is-certificate-transparency--52926101tag:soundcloud,2010:tracks/1204793467Thu, 27 Jan 2022 00:00:00 +0000Tim CallanCertificate Transparency (CT) is essential to monitoring the public SSL certificates that are issued. In this episode we explain what CT logs are, how they work, and the uses we can put them to.934falsefullhttps://www.spreaker.com/episode/root-causes-201-what-are-the-baseline-requirements--52928447tag:soundcloud,2010:tracks/1202854744Mon, 24 Jan 2022 00:00:00 +0000Tim CallanThe CA/Browser Forum Baseline Requirements (BR) are hugely influential in the world of public-trust certificates. In this episode we explain what the Baseline Requirements are, how they are created, and why they matter.975falsefullhttps://www.spreaker.com/episode/root-causes-200-why-not-to-copy-and-paste-commands-from-web-pages--52928469tag:soundcloud,2010:tracks/1199550412Wed, 19 Jan 2022 00:00:00 +0000Tim CallanThis episode describes newly revealed vulnerabilities where copying and pasting text from a web page can open the site visitor up to attack. Our hosts explain how this attack can occur and its potential consequences, along with how to defend yourself...428falsefullhttps://www.spreaker.com/episode/root-causes-199-what-is-privileged-access-management--52927644tag:soundcloud,2010:tracks/1196632735Thu, 13 Jan 2022 00:00:00 +0000Tim CallanIn this episode we explain Privileged Access Management (PAM). We go on to explain some of the ways that networks using these techniques are still vulnerable to attack and what to do about it.961falsefullhttps://www.spreaker.com/episode/root-causes-198-deep-voice-fakes--52928470tag:soundcloud,2010:tracks/1194552067Tue, 11 Jan 2022 00:00:00 +0000Tim CallanWe are all familiar with phishing in its various forms. Many people feel that they can protect themselves from fraud by verbally confirming apparent commands from senior executes. In this episode our hosts explore deep voice fakes, computer generated...893falsefullhttps://www.spreaker.com/episode/root-causes-197-tim-s-digital-haircut--52926125tag:soundcloud,2010:tracks/1192362853Fri, 07 Jan 2022 00:00:00 +0000Tim CallanIn this episode our hosts describe the extreme degree to which all business has become digital business, even the most offline businesses you can think of, including food delivery, in-restaurant dining, bricks-and-mortar retail, and naturally,...719falsefullhttps://www.spreaker.com/episode/root-causes-196-what-is-certificate-agnostic--52927284tag:soundcloud,2010:tracks/1190249227Mon, 03 Jan 2022 00:00:00 +0000Tim CallanIn 2021 the certificate industry saw the emergency of the concept of "CA agnostic." However, that is only part of the story. In this episode our hosts build on this concept to define the idea of certificate automation platforms being "certificate...627falsefullhttps://www.spreaker.com/episode/root-causes-195-ios-app-privacy-audits--52927656tag:soundcloud,2010:tracks/1185847021Mon, 27 Dec 2021 00:00:00 +0000Tim CallanThe latest update of iOS includes new capabilities for app privacy auditing and permissions. Our hosts explain the controls available on iOS and Android and how a mobile device privacy audit can be beneficial.358falsefullhttps://www.spreaker.com/episode/root-causes-194-crypto-versus-cryptocurrency--52926133tag:soundcloud,2010:tracks/1181372983Mon, 20 Dec 2021 00:00:00 +0000Tim CallanExploding interest in cryptocurrency has caused the word crypto to take on new meanings that were not part of the public dialog even a few years ago. In this episode our hosts explore both the overlap and difference between today's cryptocurrency (and...831falsefullhttps://www.spreaker.com/episode/root-causes-193-4-positive-security-trends-for-2022--52927628tag:soundcloud,2010:tracks/1179263212Thu, 16 Dec 2021 00:00:00 +0000Tim CallanOur hosts look back at four positive security trends in 2021 that industry should continue in 2022.954falsefullhttps://www.spreaker.com/episode/root-causes-192-14-security-fallacies-we-still-have-in-2021--52926794tag:soundcloud,2010:tracks/1177134874Mon, 13 Dec 2021 00:00:00 +0000Tim CallanIn this year-end lookback episode, our hosts describe 14 common fallacies that still haunt IT professionals in 2021 - and the negative effects those fallacies bring.1470falsefullhttps://www.spreaker.com/episode/root-causes-191-what-is-robotic-process-automation-rpa--52926854tag:soundcloud,2010:tracks/1174241335Wed, 08 Dec 2021 00:00:00 +0000Tim CallanAn important trend sweeping enterprise IT is Robotic Process Automation. Our hosts define RPA and explain the importance of cryptographically secured digital identity in safely implementing RPA.892falsefullhttps://www.spreaker.com/episode/root-causes-190-phishing-coinbase--52927665tag:soundcloud,2010:tracks/1168870915Mon, 29 Nov 2021 00:00:00 +0000Tim CallanIn continuation of our ongoing exploration of blockchain and cryptocurrency, our hosts describe a recently discovered exploit where attackers use weaknesses in one-time-password-based MFA to steal Coinbase accounts.539falsefullhttps://www.spreaker.com/episode/root-causes-189-what-is-ca-agnostic--52926121tag:soundcloud,2010:tracks/1161647932Wed, 17 Nov 2021 00:00:00 +0000Tim CallanCertificate Lifecycle Management (CLM) platforms can deal with certificates from a number of sources. A CLM that can provision certificates of all types from all CAs, private and public, would be described as "CA agnostic." In this episode we explain...1015falsefullhttps://www.spreaker.com/episode/root-causes-188-introduction-to-web-security--52927647tag:soundcloud,2010:tracks/1158833449Thu, 11 Nov 2021 00:00:00 +0000Tim CallanMalware and other web site attacks are a frequent problem for small businesses and can result in reputational damage and site access being blocked or hindered by end user software and services. We are joined by web site protection expert JP Armenta,...1220falsefullhttps://www.spreaker.com/episode/root-causes-187-apple-limits-term-for-s-mime-certificates--52926755tag:soundcloud,2010:tracks/1156387924Sun, 07 Nov 2021 00:00:00 +0000Tim CallanApple recently announced that it would be limiting the allowable term for public S/MIME certificates to 825 days. Our hosts explain the implications of this declaration.1014falsefullhttps://www.spreaker.com/episode/root-causes-186-digital-signature-snafu-costs-swiss-company-3-billion-euro-contract--52928443tag:soundcloud,2010:tracks/1154064493Thu, 04 Nov 2021 00:00:00 +0000Tim CallanIn this episode our hosts explain how an esoteric digital signature error rendered a 3 billion Euro manufacturing contract with the Austrian government invalid.1204falsefullhttps://www.spreaker.com/episode/root-causes-185-eu-covid-passport-root-key-stolen--52926871tag:soundcloud,2010:tracks/1152632827Mon, 01 Nov 2021 00:00:00 +0000Tim CallanThe root certificates of the EU's Covid Passport program have suffered a private key compromise and counterfeit passports are now for sale on the black market. We explain the implications of this shocking revelation.1020falsefullhttps://www.spreaker.com/episode/root-causes-184-popular-college-wifi-vulnerability-revealed--52926870tag:soundcloud,2010:tracks/1149073429Tue, 26 Oct 2021 00:00:00 +0000Tim CallanRecent research reveals that certificate misconfiguration in a commonly used college WiFi platform that can lead to exposure and theft of users' login credentials. Our hosts discuss WiFi authentication and the EAP protocol and explain how this...721falsefullhttps://www.spreaker.com/episode/root-causes-183-new-msca-attack-toolkits--52926790tag:soundcloud,2010:tracks/1145567782Thu, 21 Oct 2021 00:00:00 +0000Tim CallanAt this year's BlackHat, a talk and white paper detailed the threat of MSCA root key attacks, which can be used to create unauthorized certificates. This release includes a pair of offensive toolkits and a defensive toolkit. We explain the...859falsefullhttps://www.spreaker.com/episode/root-causes-182-let-s-encrypt-root-expiration--52928487tag:soundcloud,2010:tracks/1143877063Mon, 18 Oct 2021 00:00:00 +0000Tim CallanLet's Encrypt's recent root expiration caused widespread service outages and other hassles for online services and sites. Our hosts discuss this expiration, why so many problems resulted, and the recipe for avoiding these problems in the future.1529falsefullhttps://www.spreaker.com/episode/root-causes-179-standards-for-certificates-apart-from-ssl--46456005tag:soundcloud,2010:tracks/1112042269Mon, 23 Aug 2021 00:00:00 +0000Tim CallanRegular followers of this podcast hear a great deal about SSL, the CA/Browser Forum, and the standards governing public SSL. But SSL is not the only regulated type of public digital certificate. There are also things like S/MIME, eIDAS, code signing,...863falsefullhttps://www.spreaker.com/episode/root-causes-155-what-s-good-for-subscribers-is-good-for-relying-parties--43877496tag:soundcloud,2010:tracks/1004942434Thu, 11 Mar 2021 00:00:00 +0000Tim CallanIn this episode we explore the relationship between Relying Parties (aka users of online services) and Certificate Subscribers (aka providers of these services). We discuss the common attitude that certificate requirements that negatively impact...922falsefullhttps://www.spreaker.com/episode/root-causes-154-did-claus-peter-schnorr-just-break-rsa--43877499tag:soundcloud,2010:tracks/1001395021Mon, 08 Mar 2021 00:00:00 +0000Tim CallanA recently published paper by a reputable German mathematician and cryptographer has garnered widespread attention for its claim to have destroyed the RSA algorithm. However, many people are skeptical. Join us as we discuss the paper's content, the...1066falsefullhttps://www.spreaker.com/episode/root-causes-153-too-many-roots--43877500 We are joined once again by Tom Tansy, Chairman of the SunSpec Alliance for a deep dive in the challenges and best practices in maintaining trusted roots in complex, global supply chain ecosystems.]]>tag:soundcloud,2010:tracks/999359203Fri, 05 Mar 2021 00:00:00 +0000Tim CallanTrust models in multi-vendor environments can be particularly tricky. We are joined once again by Tom Tansy, Chairman of the SunSpec Alliance for a deep dive in the challenges and best practices in maintaining trusted roots in complex, global supply... We are joined once again by Tom Tansy, Chairman of the SunSpec Alliance for a deep dive in the challenges and best practices in maintaining trusted roots in complex, global supply chain ecosystems.]]>1402falsefullhttps://www.spreaker.com/episode/root-causes-152-digital-certificates-and-the-sunspec-alliance--43877498tag:soundcloud,2010:tracks/997187194Tue, 02 Mar 2021 00:00:00 +0000Tim CallanThe SunSpec Alliance is an important source of standards for clean energy infrastructure including solar and electric vehicles. To protect our electrical infrastructure and ensure proper functioning, digital identity and certificates are a necessity....1303falsefullhttps://www.spreaker.com/episode/root-causes-150-this-podcast-is-not-about-alan-turing--43660412tag:soundcloud,2010:tracks/986925886Sun, 14 Feb 2021 00:00:00 +0000Tim CallanRecent news of the discovery of abandoned Enigma machines on the ocean floor inspires our hosts to discuss history's most famous code system, how it was broken, and how that relates to cryptography today.1003falsefullhttps://www.spreaker.com/episode/root-causes-148-can-australia-force-sites-to-pay-for-linking-to-content--43414634tag:soundcloud,2010:tracks/981539350Mon, 08 Feb 2021 00:00:00 +0000Tim CallanA proposed law in Australia would require sites linking to news articles to pay for the right to link to these articles. While this law appears to be aimed at Google and Facebook, it has implications that are much bigger than these two news...975falsefullhttps://www.spreaker.com/episode/root-causes-144-whatever-happened-to-the-green-address-bar--43158417tag:soundcloud,2010:tracks/973295860Mon, 25 Jan 2021 00:00:00 +0000Tim CallanFor more than a decade browsers displayed the "green address bar" on sites that had undergone the high authentication required for EV SSL certificates. But in recent years the identity information in the browser has has shrunk, lost its color, and in...816falsefullhttps://www.spreaker.com/episode/root-causes-142-removing-street-address-and-postal-code-from-public-certificates--43158419tag:soundcloud,2010:tracks/968048287Mon, 18 Jan 2021 00:00:00 +0000Tim CallanOn March 1 Sectigo will remove street address and postal/zip code information from its public certificates of all types. Our hosts explain the reasons for and advantages of this upcoming change, along with answers to some of the common questions we...740falsefullhttps://www.spreaker.com/episode/root-causes-141-the-case-for-shorter-certificate-lifespans--42912107tag:soundcloud,2010:tracks/963715132Mon, 11 Jan 2021 00:00:00 +0000Tim CallanRecent years have seen multiple reductions in the maximum term for public SSL certificates. Our hosts are joined by guest Nick France to discuss the benefits of shorter certificate lifespans for both public and private CAs.1116falsefullhttps://www.spreaker.com/episode/root-causes-137-solarwinds-supply-chain-attack-and-digital-identity--42701941tag:soundcloud,2010:tracks/951929677Mon, 21 Dec 2020 00:00:00 +0000Tim CallanThe SolarWinds Orion supply chain attack is making headlines throughout the tech press. This sophisticated attack includes some unusual manipulations of digital identity and certificates. In this episode we explain how certificates, keys, and identity...1851falsefullhttps://www.spreaker.com/episode/root-causes-136-2020-lookback-quantum-safe-certificates--42701940tag:soundcloud,2010:tracks/949649428Thu, 17 Dec 2020 00:00:00 +0000Tim CallanIn the third of our year-end lookback episodes, we discuss 2020's progress in the quest for quantum-safe encryption. This includes narrowing the NIST candidate list down to fifteen algorithms, the availability of test hybrid certificates, and the...866falsefullhttps://www.spreaker.com/episode/root-causes-135-the-heartbleed-vulnerability--42701943tag:soundcloud,2010:tracks/947491852Mon, 14 Dec 2020 00:00:00 +0000Tim CallanIn April 2014 a software vulnerability called Heartbleed was discovered in OpenSSL. Heartbleed made it possible for attackers to send commands to web servers and steal their private keys. Certificate subscribers around the world had to scramble to...1489falsefullhttps://www.spreaker.com/episode/root-causes-132-examining-mfa-through-soft-tokens--42476253tag:soundcloud,2010:tracks/941507815Fri, 04 Dec 2020 00:00:00 +0000Tim CallanIn our ongoing examination of MFA, our hosts examine authentication through soft-token OTP (one-time passcode). They go over the potential benefits and pitfalls of soft tokens, and compare them to SMS tokens and hard tokens.1008falsefullhttps://www.spreaker.com/episode/root-causes-130-how-to-get-rid-of-password-breaches--42222527tag:soundcloud,2010:tracks/935180389Tue, 24 Nov 2020 00:00:00 +0000Tim CallanMassive password breeches have been so repeatedly prevalent for so many years that as an industry and a society we've just started to accept them as a fact of life. In this episode we discuss the weaknesses of passwords as a strategy and why they...960falsefullhttps://www.spreaker.com/episode/root-causes-129-examining-mfa-through-hard-tokens--42222526tag:soundcloud,2010:tracks/932271430Thu, 19 Nov 2020 00:00:00 +0000Tim CallanHard tokens are one of the oldest multi-factor authentication (MFA) form factors there is, and still in use today. In the latest in our series of explorations of MFA strategies, we examine the strengths and weaknesses of hard tokens as an MFA strategy.916falsefullhttps://www.spreaker.com/episode/root-causes-127-what-does-a-chief-compliance-officer-at-a-public-ca-do--41971114tag:soundcloud,2010:tracks/923830939Thu, 05 Nov 2020 00:00:00 +0000Tim CallanOur co-host Tim Callan has changed his title to Chief Compliance Officer. Join him and co-host Jason Soroko as they discuss what compliance means at a public Certificate Authority (CA) like Sectigo and what the Chief Compliance Officer does.849falsefullhttps://www.spreaker.com/episode/root-causes-81-what-is-embedded-firewall--7032999791e24487-f013-49d5-8b2d-83638cc095c0Mon, 06 Apr 2020 00:00:00 +0000Tim CallanSecurity for IoT devices depends not only on establishing strong identity mechanisms for devices and the services they connect to but also in ensuring the ongoing integrity of device operations. In this episode our hosts are joined by guest Alan Grau...876cybersecurity,embedded,firewall,pkifalse81fullhttps://www.spreaker.com/episode/root-causes-80-the-pros-and-cons-of-vpns--703299780ebed29c-9c40-4409-b928-bffb0571ffbfThu, 02 Apr 2020 00:00:00 +0000Tim CallanWith the sudden, meteoric increase in remote workers, many IT professionals are looking at VPN as a method of keeping them secure. Join our hosts as they discuss the advantages and disadvantages of VPNs, and what to look out for.983cybersecurity,pki,vpnfalse80fullhttps://www.spreaker.com/episode/root-causes-79-firefox-reinstates-support-for-deprecated-tls-versions--70329996b84743d1-92fc-4acb-9952-44ed5f2b0d93Mon, 30 Mar 2020 00:00:00 +0000Tim CallanTo enable broadest possible access to valuable information about the COVID-19 epidemic, Firefox has chosen to reinstate support for web sites using TLS 1.0 and 1.1. Join us to learn about this move, why Firefox has made it, and what that says about...686firefox,pki,tlsfalse79fullhttps://www.spreaker.com/episode/root-causes-78-extended-validation-certificates-and-the-dark-web--70329975025533d3-5076-4c24-9a29-c8a4e89b93bdThu, 26 Mar 2020 00:00:00 +0000Tim CallanNew research presented at RSA Security Expo indicates that at least one party is using online criminal marketplaces to sell a package of a newly-created business and at least one Extended Validation SSL certificate to go with it. Join our hosts as...882certificates,dark web,ev,pki,webpki,x509false78fullhttps://www.spreaker.com/episode/root-causes-77-certificates-for-public-cloud--703299762b97cbef-dcc6-440d-85d3-e20f9de4bb60Mon, 23 Mar 2020 00:00:00 +0000Tim CallanAs a convenience to customers and a competitive differentiator, public cloud services such as AWS offer TLS certificates for use in their environments. Join our hosts as they explain this practice, how these certificates can be used, and which use...562cloud,digital certificates,hyperscalers,pki,tls,webpki,x509false77fullhttps://www.spreaker.com/episode/root-causes-76-implications-of-covid-19-for-pki--7032997784ee2046-4b92-416a-86e5-8d25d5b9b2daFri, 20 Mar 2020 00:00:00 +0000Tim CallanCOVID-19 is rocking all aspects of our daily and business lives. So what are the implications of lock-downs, office closures, and high employee absenteeism on the PKI world? Our hosts explore the implications of our new post-pandemic work culture on...1609covid,pki,webpkifalse76fullhttps://www.spreaker.com/episode/root-causes-75-sectigo-s-covid-19-readiness--703299837c67df27-5d47-4e5a-aefd-df735b531c2aWed, 18 Mar 2020 00:00:00 +0000Tim CallanAs measures move into place throughout society to flatten the curve of COVID-19's spread, it is important to understand the potential effects of lock downs, school closures, and work-from-home mandates on the critical systems that keep our digital...281covid,readiness,sectigofalse75fullhttps://www.spreaker.com/episode/root-causes-74-device-and-network-access--70330004ed51bdd9-fbfd-4ae5-bf69-205ad0946407Tue, 17 Mar 2020 00:00:00 +0000Tim CallanCertificates can play a critical role in enabling and controlling access for users and devices to our sensitive business processes and data. Our hosts are joined once again by David Colon as we explore the role certificates play in providing network...885access control,device,network,pki,tls,x509false74fullhttps://www.spreaker.com/episode/root-causes-73-apple-to-drop-support-for-two-year-ssl-certificates--703299652b19d9e7-e0a9-4bed-af76-90b48915281cFri, 13 Mar 2020 00:00:00 +0000Tim CallanAt the most recent Face-to-Face meeting of the CA/Browser Forum, Apple announced that as of September 1 it will distrust public TLS certificates issued with terms longer than thirteen months for all its technology products. Join our hosts as they...1239apple,certificate lifecycle manageme,certificate lifespans,clm,pki,tls,webpkifalse73fullhttps://www.spreaker.com/episode/root-causes-72-future-proofing-your-pki--70329973921aab08-6c1b-4178-9c0c-80b44a391488Tue, 10 Mar 2020 00:00:00 +0000Tim CallanFormer CableLabs CIO and Kyrio President and General Manager Mitch Ashley joins our hosts to discuss how to set up a PKI system that will meet your needs for many years to come. Mitch is now CEO of Accelerated Strategies Group, a disruptive analyst...2069cable labs,mitch ashley,pki,tls,x509false72fullhttps://www.spreaker.com/episode/root-causes-71-short-lived-devops-certificates--703299799f858e45-9f3b-4164-adbf-1bf52b2863deFri, 06 Mar 2020 00:00:00 +0000Tim CallanRepeat guest and DevOps expert David Colon joins us again to discuss identity for microservices, including the use of very short-lived TLS certificates. David and our hosts explore the unique properties of PKI in these environments and describe how to...1261certificate lifecycle manageme,certificate lifespans,david colon,devops,pki,tls,x509false71fullhttps://www.spreaker.com/episode/root-causes-70-identity-is-the-new-perimeter--70329966d8010fd5-a836-470a-b071-10a6eacb45fcWed, 04 Mar 2020 00:00:00 +0000Tim CallanModern architectures and development processes have shattered the old concept of an IT perimeter for the enterprise. In this world, attaching strong identity to every device, user, and process is essential to security. In this episode our hosts...1645cybersecurity,digital identities,pki,tls,webpki,x509false70fullhttps://www.spreaker.com/episode/root-causes-69-fundamentals-of-devops-and-pki--70329986abc35835-7b62-4d07-af05-b49a58da47cfFri, 28 Feb 2020 00:00:00 +0000Tim CallanIn our ongoing series on DevOps and PKI, DevOps practitioner David Colon joins us to help describe the intersection of DevOps security and PKI. We explore how PKI fits in with orchestration engines like Kubernetes and some of the practical...1331certificate lifecycle manageme,certificate lifespans,devops,pki,tls,webpki,x509false69fullhttps://www.spreaker.com/episode/root-causes-68-why-sha-1-is-no-longer-secure--703299896ad7e15f-5e71-49b6-9102-5eebe87203cbMon, 24 Feb 2020 00:00:00 +0000Tim CallanSHA-1 was a cornerstone of the early secure web. Now, 25 years later, this hashing function is no longer secure. Join our hosts to hear the history of SHA-1, its common use cases, and the properties of an effective hashing function. Learn about...1914cryptographic primitive,cryptography,hashing algorithm,pki,sha-1,tls,x509false68fullhttps://www.spreaker.com/episode/root-causes-67-definition-of-devops-and-devsecops--70329981c4fe3eff-7fd2-4be6-b6de-527c0a95d8eaFri, 21 Feb 2020 00:00:00 +0000Tim CallanOur hosts are joined by senior DevOps engineer David Colon to explore what DevOps means in today's enterprise. They cover diverse aspects of the DevOps phenomenon, including cultural implications, "configuration drift," definition of release velocity,...1332certificate lifecycle manageme,certificate lifespans,devops,devsecops,pki,tls,x509false67fullhttps://www.spreaker.com/episode/root-causes-66-functional-versus-homomorphic-encryption--70329982e2a3d59c-eec3-4229-8553-2f2a3f529dbeTue, 18 Feb 2020 00:00:00 +0000Tim CallanTraditionally, file encryption is an all-or-nothing affair where data cannot be gleaned from the encrypted file without fully decrypting its contents. A new brand of cryptography called homomorphic encryption makes it possible for specific types of...943cryptography,encryption,homomorphic,pkifalse66fullhttps://www.spreaker.com/episode/root-causes-65-quantum-key-distribution--7032998811111448-1759-44fe-8724-d5c53e4777adMon, 10 Feb 2020 00:00:00 +0000Tim CallanQuantum key distribution is a new technology that uses the principles of quantum physics to generate and distribute truly random keys for encrypted communication. Join us as we explain how quantum key distribution works, why it is not the same as...1081pki,qkd,quantum,quantum key distributionfalse65fullhttps://www.spreaker.com/episode/root-causes-64-what-is-digital-identity--70330010d5c905f7-1c25-4eb4-b509-029556c15527Tue, 04 Feb 2020 00:00:00 +0000Tim CallanThe phrase "identity is the new perimeter" has gained in use of late, reflecting the reality that today's modern enterprise architecture is a mix of traditional and cloud, owned and rented and BYOD, all together in a complex mix. Under those...1785identity,identity is the new perimeter,pki,tls,x509false64fullhttps://www.spreaker.com/episode/root-causes-63-what-is-caa--703300032c35d72c-f115-4d2d-8ef5-44fec3c43047Wed, 29 Jan 2020 00:00:00 +0000Tim CallanCAA, which stands for CA Authentication, is the capability for the domain name owner to specify in DNS which CAs are allowed to issue SSL certificates for a specific domain. Join us to learn more about CAA, including how it works and its potential...596caa,digital certificates,pki,webpki,x509false63fullhttps://www.spreaker.com/episode/root-causes-62-windows-cryptoapi-spoofing-vulnerability-explained--703300050c9af701-0c22-4dff-afbb-3ac23699a9eeWed, 22 Jan 2020 00:00:00 +0000Tim CallanOn January 14 Microsoft announced a sweeping vulnerability that makes it possible to defeat the authentication of Elliptic Curve Cryptography (ECC) on Windows 10 and Windows Server systems, making it possible to create fake certificates on trusted...1099cryptography,elliptic curve,microsoft,pki,webpkifalse62fullhttps://www.spreaker.com/episode/root-causes-61-anatomy-of-a-cryptocurrency--703300155fadf7c0-9dfb-4ffd-afdc-25a95636d386Fri, 10 Jan 2020 00:00:00 +0000Tim CallanIn our ongoing series about blockchain, we explore the technology, process, and ecosystem needs for a successful cryptocurrency. Join our hosts along with expert guest Alan Grau as we discuss the technology and ecosystem specifics of cryptocurrencies,...1887crypto,cryptocurrency,crypto wallet,pkifalse61fullhttps://www.spreaker.com/episode/root-causes-60-fundamentals-of-blockchain--703300060678187b-1554-4a3c-a25d-97b26647a63fMon, 06 Jan 2020 00:00:00 +0000Tim CallanWidely understood to be the technology behind popular crypto currencies, blockchain has become a household word. But what it blockchain really, and how does it work? Join our hosts and returning guest Alan Grau as they explain how blockchain...1293blockchain,pkifalse60fullhttps://www.spreaker.com/episode/root-causes-59-what-is-certificate-transparency--70329969b2008753-0d63-4ad7-9d46-a1876d5a1a59Mon, 30 Dec 2019 00:00:00 +0000Tim CallanCertificate Transparency (CT) is a recent and important development in the world of SSL certificates. Popular browsers require trusted CAs to log all SSL certificates to publicly available CT Logs. Join our hosts to find out how various parties are...1287certificate transparency,ct logs,pki,ssl,tls,webpki,x509false59fullhttps://www.spreaker.com/episode/root-causes-58-2019-lookback-one-year-of-podcasting--70330017acb83dc0-dff3-4766-9a55-5a76972d5214Mon, 16 Dec 2019 00:00:00 +0000Tim CallanNearly a year ago our hosts launched Root Causes to provide a forum for discussion of the issues surrounding the critically important PKI technology. Now at the end of 2019 we discuss how this podcast has taken shape, how that compares to our original...840pki,ssl,tls,webpkifalse58fullhttps://www.spreaker.com/episode/root-causes-57-quantum-random-number-generation--703299921844bb63-5c01-4612-8bec-737a3a1a61b2Thu, 12 Dec 2019 00:00:00 +0000Tim CallanRandom number generation is an essential part of successful cryptography. Quantum computers offer to improve this niche technology industry. Join our hosts to learn what quantum random number generators (qRNGs) are, how they stand to improve...1133pki,qrng,quantum,quantum random number generati,ssl,tls,webpkifalse57fullhttps://www.spreaker.com/episode/root-causes-56-2019-lookback-evolving-cryptography--70329990310d9889-ff4b-40d3-86a8-ae6e96f9c3aeMon, 09 Dec 2019 00:00:00 +0000Tim Callan2019 saw important changes in the world's cryptographic standards, including changes in browser treatment of SSL certificates, the removal of a public CA from trusted root stores, widespread serial number entropy problems across many CAs, and progress...1391cryptography,encryption,pki,ssl,tls,webpkifalse56fullhttps://www.spreaker.com/episode/root-causes-55-california-s-new-iot-security-law--70329985789b76f8-97ec-4413-bdc0-102330f1270cThu, 05 Dec 2019 00:00:00 +0000Tim CallanCalifornia Senate Bill 327 (SB-327) goes into effect January 1, 2020. This groundbreaking ordinance requires basic security measures for devices deployed in California. Join us to learn what SB-327 requires from device manufacturers, which threats it...1337cryptography,encryption,iot,pki,ssl,tls,webpkifalse55fullhttps://www.spreaker.com/episode/root-causes-54-2019-lookback-infrastructure-and-iot-security--70330025161934f7-19b2-4722-8e96-6156fe04103bTue, 03 Dec 2019 00:00:00 +0000Tim Callan2019 was a highly eventful year for infrastructure and IoT security. The year saw the emergence of wholesale attacks on the world's energy infrastructure, an epidemic of ransomware incidents against municipalities, heightened attention to automotive...1475cryptography,encryption,iotpki,ssl,tls,webpkifalse54fullhttps://www.spreaker.com/episode/root-causes-53-2019-lookback-governments-try-to-control-pki--703299875003a248-5786-438f-98c7-12436a7e343fMon, 25 Nov 2019 00:00:00 +0000Tim Callan2019 has been an eventful year for PKI. In this episode, first in a series of four lookbacks at the year, our hosts discuss how governments sought to control encryption, certificates, and public trust in 2019.1136cryptography,encryption,government,government vs encryption,pki,ssl,tls,webpkifalse53fullhttps://www.spreaker.com/episode/root-causes-52-new-tls-certificate-incident-research--70329999d26a65c5-2872-4575-ab42-3a584b3c26d4Fri, 22 Nov 2019 00:00:00 +0000Tim CallanNew research out of Indiana University Bloomington reviews nearly 400 "incidents" with public SSL certificates over the course of more than a decade. Join us as we go through the main findings from this piece of original research, including...1448cryptography,encryption,pki,ssl,tls,webpkifalse52fullhttps://www.spreaker.com/episode/root-causes-51-blockchain-vs-pki--70329995cd51e97c-912e-4ca1-a378-7d90ac613b4dTue, 19 Nov 2019 00:00:00 +0000Tim CallanIn our industry interactions we frequently run into questions about how PKI and blockchain compare with each other. How do they work similarly or differently? Are they surrogates for each other? Are they complimentary? Join us this episode as we...1774blockchain,pki,ssl,tls,webpkifalse51fullhttps://www.spreaker.com/episode/root-causes-50-energy-infrastructure-cyber-attacks--703299940ad62046-b7b5-43dc-9c70-9c08777df9a8Fri, 08 Nov 2019 00:00:00 +0000Tim CallanGlobal energy infrastructure continues to find itself under cyber attack from Advanced Persistent Threats (APTs). Join our hosts as we discuss recent attacks on power plants, why these attacks persist, and possible responses.1348critical infrastructure,cryptography,encryption,energy,iot,pki,ssl,tls,webpkifalse50fullhttps://www.spreaker.com/episode/root-causes-49-california-consumer-privacy-act--70330000e80a9d26-a4d6-4a59-a4e8-c7b578e9b305Wed, 06 Nov 2019 00:00:00 +0000Tim CallanThe California Consumer Privacy Act (CCPA) has been described by some as California's GDPR. This act provides broad protections to consumers in California, and businesses must comply starting January 1, 2020. Join us as we discuss this act, what...851ccpa,privacyfalse49fullhttps://www.spreaker.com/episode/root-causes-48-weaknesses-in-mfa-authentication--70330019adf704cb-72c3-4624-a534-b0544ef61084Thu, 31 Oct 2019 00:00:00 +0000Tim CallanA recent FBI warning cautions of attacks that circumvent Multi-Factor Authentication (MFA). Join us as we describe contemporary attacks against MFA and how to defend against them.936cybersecurity,mfa,multi factor authenticationfalse48fullhttps://www.spreaker.com/episode/root-causes-47-quantum-apocalypse-quantum-resistant-cryptography-for-iot--70329998fffdd081-f3e0-44dd-8e51-5298b37e1029Fri, 25 Oct 2019 00:00:00 +0000Tim CallanExpert consensus states that we will need to update cryptography before quantum computers break our existing algorithms in the next ten or fifteen years. But what do we do about IoT devices, which may lack updating mechanisms and live in the field...1058cryptography,encryption,mosca,pki,q date,quantum,ssl,tls,webpki,z datefalse47fullhttps://www.spreaker.com/episode/root-causes-46-criminals-are-patching-browsers-for-tls-fingerprinting-attacks--70330024a7e4ab81-0e09-4122-a76d-a2b92d3a7177Tue, 22 Oct 2019 00:00:00 +0000Tim CallanIn a new variant on a known attack, a Russian Advanced Persistent Threat has begun applying patches to Chrome and Firefox to enable TLS fingerprinting even after the malware is removed from a system. To learn more about this new development, join our...818cryptography,encryption,pki,ssl,tls,webpkifalse46fullhttps://www.spreaker.com/episode/root-causes-45-what-is-the-ca-browser-forum--70330027a968ede9-aabd-4e15-8517-1467298971ffFri, 18 Oct 2019 00:00:00 +0000Tim CallanSSL certificate practices are governed by the rules of the CA/Browser Forum. But what is the CA/Browser Forum, who is in it, and where do they get their authority? If you've ever wondered about questions like these join our hosts as they describe the...1395pki,ssl,tls,webpkifalse45fullhttps://www.spreaker.com/episode/root-causes-44-automotive-device-security--703300077f67caf5-f703-44aa-868b-ca332afa1c5bTue, 15 Oct 2019 00:00:00 +0000Tim CallanThe automobile is undoubtedly among today's most complex, commonplace, and security-sensitive IoT devices. Our hosts describe the cyber threats facing connected cars, including real attacks that already have been proven, new challenges that will come...1029automobile,automotive,cars,cryptography,encryption,pki,ssl,tls,webpkifalse44fullhttps://www.spreaker.com/episode/root-causes-43-quantum-apocalypse-more-on-mosca-s-inequality--70329993bb48da1c-7324-4cbf-8a43-46d2e3a17008Fri, 11 Oct 2019 00:00:00 +0000Tim CallanIn episode 35 our hosts explained Mosca's Inequality, a formula for calculating when we need to have post-quantum encryption in place to prevent the Quantum Apocalypse. In this episode our hosts embark on a nuanced exploration of the factors...1349cryptography,encryption,mosca,pki,q date,quantum,ssl,tls,webpki,z datefalse43fullhttps://www.spreaker.com/episode/root-causes-42-anatomy-of-a-botnet--703300019c904dee-43dd-4f82-9c7a-b6036ec2c360Tue, 08 Oct 2019 00:00:00 +0000Tim CallanWe talk about botnets a lot, but not everyone understands how they are built and used by the criminals who control them or how headless IoT devices have greatly added to their power. Expert guest Alan Grau (VP of IoT and Embedded Security, Sectigo)...1484botnet,cybersecurityfalse42fullhttps://www.spreaker.com/episode/root-causes-41-what-is-blockchain-s-killer-app--7033002859c5627b-e8ac-4819-8c19-a3c6c1f04da5Thu, 03 Oct 2019 00:00:00 +0000Tim CallanOur hosts frequently run into the assumption that blockchain and PKI are extremely similar technologies and are possibly even competitive to each other. While the two approaches accomplish some related goals, they are very different in how they work...879blockchain,cryptography,encryption,pki,ssl,tls,webpkifalse41fullhttps://www.spreaker.com/episode/root-causes-40-the-reports-of-rsa-s-death-are-greatly-exaggerated--703300131d7e6cc5-9ea6-4d94-831e-f129724609eeTue, 01 Oct 2019 00:00:00 +0000Tim CallanRecently at Black Hat and on public YouTube videos security newcomer Crown Sterling has claimed to factor the RSA algorithm. It turns out the breathlessly discussed feats were already accomplished as early as 1999. Join our hosts as they debunk this...550cryptography,encryption,mosca,pki,q date,quantum,rsa,ssl,tls,webpki,z datefalse40fullhttps://www.spreaker.com/episode/root-causes-39-new-university-research-on-phishing-and-certificates--7033003756a07776-a7da-4da0-b533-68994a576797Thu, 26 Sep 2019 00:00:00 +0000Tim CallanThe majority of all phishing sites now use SSL certificates to more closely imitate the behavior of legitimate sites. New research from RWTH Aachen, a large, German technical university, investigates the patterns behind this certificate usage. Join...1203cryptography,encryption,pki,ssl,tls,webpkifalse39fullhttps://www.spreaker.com/episode/root-causes-38-interesting-breaches-in-august--70330011dd08ecfb-4bfd-4efb-840a-fa52b3518ff8Tue, 24 Sep 2019 00:00:00 +0000Tim CallanThe month of August saw some unusual criminal activity when it comes to PKI and malware. Our hosts explain four August news stories including a SHA-1 enabled breach, stolen certificates and keys, and some interesting developments with malware-driven...1724cryptography,encryption,pki,ssl,tls,webpkifalse38fullhttps://www.spreaker.com/episode/root-causes-37-quantum-apocalypse-will-quantum-annealing-break-cryptography--70330029fccf8537-d355-4373-a889-696240a0fc48Tue, 10 Sep 2019 00:00:00 +0000Tim CallanQuantum annealing is a special case of quantum computing for which the engineering challenges are lessened - and therefore we expect computers of this sort to achieve stability sooner. In this episode we examine the potential for the quantum annealing...1235annealing,cryptography,encryption,pki,quantum,ssl,tls,webpkifalse37fullhttps://www.spreaker.com/episode/root-causes-36-quantum-apocalypse-the-search-for-quantum-resistant-crypto--7033001841d2d230-f453-4f7e-94a1-f3f972d074f5Tue, 03 Sep 2019 00:00:00 +0000Tim CallanFinding the new quantum-resistant cryptography we will need to replace RSA and ECC is a difficult task requiring the coordinated effort of academics, industry, and government. NIST has stepped in to lead this volunteer community. Join us to learn...1262cryptography,encryption,mosca,pki,q date,quantum,ssl,tls,webpki,z datefalse36fullhttps://www.spreaker.com/episode/root-causes-35-quantum-apocalypse-mosca-s-inequality-mad-max-and-mohawks--703300261de724b5-d69c-4ab2-898a-1cdd8470ba59Thu, 29 Aug 2019 00:00:00 +0000Tim CallanQuantum computers have the potential to defeat the RSA and ECC encryption underlying our digital world. We must swap out these algorithms before quantum computers reach that stage of maturity. But how long to we have? Join our hosts Tim Callan and...1186cryptography,encryption,mosca,pki,q date,quantum,ssl,tls,webpki,z datefalse35fullhttps://www.spreaker.com/episode/root-causes-34-shadow-it-and-pki--7033004730df85f1-c55a-4ca6-8d5d-b30f83a7ab2cMon, 26 Aug 2019 00:00:00 +0000Tim CallanShadow IT has become a fact of the modern enterprise. SaaS, BYOD, outsourced development, embedded IT, DevOps, and public cloud have all chipped away at the CIO's ability to oversee and control the enterprise's technology systems. This fragmentation...1372certificate lifecycle manageme,cryptography,discovery,encryption,mosca,pki,q date,quantum,rogue certificates,shadow it,ssl,tls,webpki,z datefalse34fullhttps://www.spreaker.com/episode/root-causes-33-prepare-for-one-year-limits-on-ssl-certificates--70330008bfdc1c83-b242-4048-a584-c93ea14c4cf4Tue, 20 Aug 2019 00:00:00 +0000Tim CallanThe CA/Browser Forum faces a proposed ballot to limit the maximum duration of an SSL certificate to 13 months. Even if this ballot fails, browsers such as Google Chrome have the ability to simply distrust certificates of longer duration, creating the...1020certificate lifespans,pki,ssl,tls,webpkifalse33fullhttps://www.spreaker.com/episode/root-causes-32-why-do-browsers-and-academic-research-say-different-things-about-ev-ssl--70330049c51ef5ae-9b56-42cd-8be3-9789925da9feThu, 15 Aug 2019 00:00:00 +0000Tim CallanBreaking research from two esteemed universities shows that sites with Extended Validation SSL certificates are much less likely to be engaged in criminal behavior like malware and phishing. And yet, leading browsers are reducing or removing EV...1487ev,pki,ssl,tls,webpkifalse32fullhttps://www.spreaker.com/episode/root-causes-31-using-pki-to-authenticate-phone-callers--70330021b96c26cb-1a3b-4698-8829-8f35d0a49411Tue, 13 Aug 2019 00:00:00 +0000Tim CallanFew people know that caller ID numbers have no identity value as they are completely self-reported. This fact enables the plague of robocalling scams sweeping our society right now. Join our hosts as they discuss public telephony systems and other...686pkifalse31fullhttps://www.spreaker.com/episode/root-causes-30-when-a-whole-country-has-its-pii-stolen-giant-breach-fines-phishing-with-ssl--7033002312bf9063-7b4c-4b2d-a071-c605f25889d6Tue, 06 Aug 2019 00:00:00 +0000Tim CallanRecently we have seen major news items in some of the common Root Causes themes. Join our hosts as they discuss new whopping breach fines from GDPR and the FTC, what happens when an entire country has its PII stolen, and phishing sites with SSL.993gdpr,pki,ssl,tls,webpkifalse30fullhttps://www.spreaker.com/episode/root-causes-special-bulletin-kazakhstan-weaponizes-the-public-ca--70330032fdae773b-25b7-4ef8-9d5c-3951e440701dWed, 31 Jul 2019 00:00:00 +0000Tim CallanThe Kazakhstan government is taking measures to force citizens to trust its own root, enabling the widespread persecution of dissidents, journalists, and human rights advocates. Join our hosts to learn the long history of Kazakhstan's weaponization of...1063e2ee,government vs encryption,pki,webpkifalsebonushttps://www.spreaker.com/episode/root-causes-29-vulnerabilities-in-cisco-routers-and-other-device-integrity-controls--7033001242f51380-b01e-4187-8e54-957c152fc405Thu, 25 Jul 2019 00:00:00 +0000Tim CallanSecurity flaws in the device integrity modules of Cisco routers and other devices have lately filled the headlines. Join our hosts and guest Alan Grau as they discuss what is happening with these flaws, why, and what to do about it.1320cisco,cybersecurity,routersfalse29fullhttps://www.spreaker.com/episode/root-causes-28-ssl-certificate-automation-through-acme--70330038249e164f-1329-4d49-82a5-ccaf84a82ba5Mon, 22 Jul 2019 00:00:00 +0000Tim CallanACME is a new SSL certificate automation standard that is taking the world by storm. With support by 150 million web sites and more than 130 open source tools, ACME is a key tool in your digital certificate bag. Join our hosts and guest Abul Salek as...1377acme,certificate lifecycle manageme,pki,ssl,tls,webpkifalse28fullhttps://www.spreaker.com/episode/root-causes-27-pending-safe-browser-guidelines-from-germany--703300305d69659c-a686-46d1-baaa-1d443a98237aThu, 18 Jul 2019 00:00:00 +0000Tim CallanThe German government has published a draft of its latest guidelines for safe browsers, which include requirements for how SSL certificates are supported and treated. Join our hosts as they discuss the German safer browser requirements and their...1019browser,germany,pki,ssl,tls,webpkifalse27fullhttps://www.spreaker.com/episode/root-causes-26-the-white-house-wants-to-prohibit-end-to-end-encryption--70330031d4966291-a254-46e7-bb71-da6e1b0c8663Sun, 14 Jul 2019 00:00:00 +0000Tim CallanThe White House is the latest government entity seeking to defeat widespread encryption technology through legislated "back door" access. Join our hosts as they explain why such an idea is essentially unworkable and would endanger the confidential...1111cryptography,e2ee,encryption,end to end encryption,pki,ssl,tls,webpkifalse26fullhttps://www.spreaker.com/episode/root-causes-25-entropy-and-random-numbers--703300361a514ed3-305e-4d3b-97f0-efb5e797fc6cTue, 02 Jul 2019 00:00:00 +0000Tim CallanOne cornerstone of successful cryptography is entropy, or the ability to create genuinely unpredictable values. But it turns out that generating truly random numbers is harder than you might think. Join our hosts as they discuss the need for...1156cryptography,encryption,entropy,pki,randomness,ssl,tls,webpkifalse25fullhttps://www.spreaker.com/episode/root-causes-24-certificate-revocation--7033003527a093ec-8dcc-4e10-bb8c-2459926995bfThu, 27 Jun 2019 00:00:00 +0000Tim CallanOccasional certificate revocation is an essential part of the digital certificate lifecycle and any secure PKI scheme. Not only do certificate owners need the revoke their own certificates, but also CAs sometimes need to revoke certificates to keep...928certificate lifecycle manageme,pki,revocation,ssl,tls,webpkifalse24fullhttps://www.spreaker.com/episode/root-causes-23-global-energy-grids-under-cyber-attack--703300339ee2ae8a-a8cb-4a08-b8b6-40d1e0618780Thu, 20 Jun 2019 00:00:00 +0000Tim CallanThe world's energy grids and other utilities have increasingly become targets for cyber attack, both state-sponsored and otherwise. Join our hosts as they discuss the latest developments, possible consequences of cyber war against energy grids, and...949critical infrastructure,cybersecurity,operational technology,ot,ssl,tls,webpkifalse23fullhttps://www.spreaker.com/episode/root-causes-22-attacks-on-us-cities-with-eternalblue-cyber-weapon--703300511a4c0f33-4bee-49e3-ad7d-0a4c12fd4af2Fri, 07 Jun 2019 00:00:00 +0000Tim CallanA recent spate of ransomware attacks against US municipalities is noteworthy for being enabled by the stolen US cyber weapon EternalBlue. Join our hosts as we explain this attack, its similarities to earlier incidents, and the whole syndrome of...1062cybersecurityfalse22fullhttps://www.spreaker.com/episode/root-causes-21-new-texas-energy-grid-security-regulation--70330044ecfbf61d-1a7f-4e16-b3b3-44c06c5cbcd0Wed, 05 Jun 2019 00:00:00 +0000Tim CallanThe state of Texas is leading the way with new legislation requiring cyber protections for its energy grid. Join our hosts as we explain this legislation, why it comes now, and its potential impact on the greater energy industry.1102cybersecurity,ot,regulation,texas energy gridfalse21fullhttps://www.spreaker.com/episode/root-causes-20-885-million-first-american-financial-customer-docs-exposed--7033005263860078-3332-456f-a514-25250b62839eFri, 31 May 2019 00:00:00 +0000Tim CallanIt was recently revealed that First American Title Corporation had 885 million confidential customer financial documents discoverable in the clear on its online site. These documents contain all the most sensitive information necessary for identity...845cybersecurityfalse20fullhttps://www.spreaker.com/episode/root-causes-19-death-of-a-public-ca--7033005010f25621-c108-4796-a13c-cd214dd2f6f9Thu, 30 May 2019 00:00:00 +0000Tim CallanMozilla has decided to remove a public CA from its trusted root store. By doing so Mozilla renders public certificates from this CA essentially valueless for almost all use cases. Join our hosts as the examine the reasons for this decision, how CA...840distrust,pki,ssl,tls,webpkifalse19fullhttps://www.spreaker.com/episode/root-causes-18-sha-1-collisions-tls-fingerprinting-cisco-trust-anchor-flaw--703300587b7927f8-f2e1-4a1d-841f-85939f4f303bThu, 23 May 2019 00:00:00 +0000Tim CallanRecent news has revealed several important developments in PKI and cyber trust. Our hosts cover the latest SHA-1 collision attack and why it signals the inevitable death of this hashing algorithm. We explain TLS fingerprinting and how it enables...1305cryptographic primitive,hashing,pki,sha-1,ssl,tls,webpkifalse18fullhttps://www.spreaker.com/episode/root-causes-17-sectigo-acquires-icon-labs--70330042f0bf4361-85b3-4f51-b4b4-0ccc7968129fThu, 16 May 2019 00:00:00 +0000Tim CallanSectigo's recent acquisition of Icon Labs expands the company's capabilities in embedded OEM and device identity. Jason and Tim are joined by Icon Labs co-founder Alan Grau as our podcasters explore the needs and potential vulnerabilities for...1184cybersecurity,embedded,iot,pki,tlsfalse17fullhttps://www.spreaker.com/episode/root-causes-16-pki-for-devops-environments--7033006361a1f179-7365-434e-afc3-c6c62be1fa5aTue, 14 May 2019 00:00:00 +0000Tim CallanDevOps as a software development and deployment methodology has radically transformed enterprise computing. This approach brings with it new architectures and tools such as containerization, Kubernetes, and multi-cloud. Learn how PKI plays a critical...1399devops,devsecops,mtls,pki,ssl,tlsfalse16fullhttps://www.spreaker.com/episode/root-causes-15-architecture-for-enterprise-certificate-automation--703300647c822f94-8707-4ee7-a183-76dd5eb4c238Tue, 07 May 2019 00:00:00 +0000Tim CallanAutomation of certificate deployment and management is a must for today's enterprise. Complexity, changing environments, fast time to market, and simply scale all dictate that the old manual management methodology is dying away. Join our hosts as they...1156certificate lifecycle manageme,certificate lifespans,pki,ssl,tls,webpkifalse15fullhttps://www.spreaker.com/episode/root-causes-14-p2p-vulnerability-in-iot-devices--703300653884127a-f112-47b9-ac6e-c4a1ac060abeThu, 02 May 2019 00:00:00 +0000Tim CallanRecent research reveals millions of consumer IoT devices that lack any level of authentication or encryption at all. Join our hosts as we discuss the nature of IoT-based botnets and their negative consequences on enterprises, consumers, and the...1322iot,pki,ssl,tls,webpkifalse14fullhttps://www.spreaker.com/episode/root-causes-13-pki-for-iot--703300165ffee02e-c2db-4cd9-99f7-48c404d61732Thu, 25 Apr 2019 00:00:00 +0000Tim CallanThe proliferation of Internet of Things (IoT) devices in many cases has outpaced security for those devices, leaving enterprises, end users, and the general public exposed. Learn how identity is an essential part of protecting any service involving...1215cybersecurity,iot,pki,ssl,tls,webpkifalse13fullhttps://www.spreaker.com/episode/root-causes-12-pki-in-the-news--7033002201a8d7c6-5e4c-446f-b510-8ab4e46a557eTue, 16 Apr 2019 00:00:00 +0000Tim CallanIt was a busy news week for PKI and authenticated identity, and our hosts run through four current stories to clarify them. Tune in to learn the latest about the Dragonblood WPA3 vulnerability, Russian spoofing of GPS/GNSS navigation signals, Know...1151pki,ssl,tls,webpkifalse12fullhttps://www.spreaker.com/episode/root-causes-11-authentication-is-not-for-the-authenticated--70330053a24ac683-c597-4ba7-a79d-15a795a54379Thu, 11 Apr 2019 00:00:00 +0000Tim CallanWith so much debate about the role and importance of authentication in digital systems, it is important to remember the purpose of authenticated identity in our cyber interactions. Join us for a discussion of who benefits from known identity, what can...850authentication,cryptography,encryption,pki,signing,ssl,tls,webpkifalse11fullhttps://www.spreaker.com/episode/root-causes-10-s-mime-automated-deployment--7033006775d8ad47-e138-42b1-8d10-ea0dc5645830Wed, 03 Apr 2019 00:00:00 +0000Tim CallanS/MIME certificates indicate the authentic identity of the sender and enable encryption for message content and attachments - providing strong defenses against a variety of email-based attacks. Nonetheless, adoption today is extremely small. Find out...1121email,encryption,pki,signing,s/mime,ssl,tlsfalse10fullhttps://www.spreaker.com/episode/root-causes-09-63-bit-serial-numbers--70330039b796eeb4-841c-4b2c-9f47-036d3487ef6bMon, 25 Mar 2019 00:00:00 +0000Tim CallanA recently discovered flaw in common practices reveals that potentially millions of active SSL certificates fall short of cryptographic requirements. Learn how it is that 64-bit certificate serial numbers might offer only 63 bits of entropy and what...912bit length,pki,ssl,tls,webpkifalse9fullhttps://www.spreaker.com/episode/root-causes-08-free-pki-is-not-free--70330060f4a6dfed-40f1-4000-b760-92866a71afa5Tue, 19 Mar 2019 00:00:00 +0000Tim CallanThe promise of a "free" Microsoft CA was alluring to enterprises in the 2000s, but today's increasingly open computing architectures and agile development methodology have outgrown your old fashioned Microsoft CA. Learn about the seven common use...1139microsoft adca,msca,pki,ssl,tlsfalse8fullhttps://www.spreaker.com/episode/root-causes-07-russian-disconnection-from-the-internet--70330040dbc9ce20-8cd0-4f5e-a6b2-0d008c2ada95Sat, 09 Mar 2019 23:50:00 +0000Tim CallanRussia has stated that it will disconnect from the internet as a trial exercise for full-blown cyber warfare. This idea presents many problems for Russian services, systems, and businesses, especially since they depend on global systems such as DNS...691sovereign internetfalse7fullhttps://www.spreaker.com/episode/root-causes-06-quantum-resistant-cryptography--70330043b9483238-8dad-4371-b40a-ba82ce09a6caSat, 09 Mar 2019 23:00:00 +0000Tim CallanThe pending cryptographic Quantum Apocalypse requires that we replace the hashing and encryption algorithms used through the internet, enterprise networks, mobile service, and popular devices. Join our experts to learn more about the requirements for...1244cryptography,encryption,mosca,pki,q date,quantum,ssl,tls,webpki,z datefalse6fullhttps://www.spreaker.com/episode/root-causes-05-cryptographic-quantum-apocalypse--7033004652976ddf-4226-4968-806a-90269e54ab71Sat, 09 Mar 2019 22:00:00 +0000Tim CallanThe pending cryptographic Quantum Apocalypse requires that we replace the hashing and encryption algorithms used through the internet, enterprise networks, mobile service, and popular devices. Join our experts to learn more about the requirements for...1150cryptography,encryption,mosca,pki,q date,quantum,ssl,tls,webpki,z datefalse5fullhttps://www.spreaker.com/episode/root-causes-04-australia-s-new-it-security-back-door--703300567106c3f8-7276-4480-b9e6-1c31936daf78Fri, 08 Mar 2019 19:00:00 +0000Tim CallanAustralia now requires a back door to IT systems. Our hosts are skeptical that this idea will work. Join our PKI experts to learn about the dangers and pitfalls of such a system - and why they have failed in the past.1508australia,e2ee,government vs encryptionfalse4fullhttps://www.spreaker.com/episode/root-causes-03-us-government-shutdown-and-security-vulnerabilities--703300458dc7f45a-2365-4f69-abea-33e82f4b20eeFri, 08 Mar 2019 15:00:00 +0000Tim CallanThe US government shutdown has taken its toll on IT systems. Services are going offline, and we are ill equipped to deal with a major security or service crisis. Tune in to learn more about the risks of the ongoing shutdown to the government's...923cryptography,encryption,pki,ssl,tls,webpkifalse3fullhttps://www.spreaker.com/episode/root-causes-02-o2-outage-and-equifax-breach--703300575cd325f2-a53b-42de-b745-91acae75fbaeFri, 08 Mar 2019 14:00:00 +0000Tim CallanIn December users of O2, Softbank, and other mobile services experienced a day-long data outage affecting as many as 40 million people. In the summer of 2017 148 million Americans lost their personal data in the Equifax breach. The common thread?...947breach,certificate lifecycle manageme,cryptography,encryption,outage,pki,ssl,tls,webpkifalse2fullhttps://www.spreaker.com/episode/root-causes-01-introduction--70330048c1a4de7b-944c-4681-a0ec-1df0fa6ebb6bFri, 08 Mar 2019 00:00:00 +0000Tim CallanIntro to the leading PKI and security podcast. Learn your hosts' qualifications and reasons for creating this podcast.505pki,root causes podcast,webpkifalse1full