Root Causes 484: Multi Good Factor Authentication

Root Causes: A PKI and Security Podcast

#Tech #Tim Callan #Jason Soroko

32:12

DaQuane Cherry was once the kid who wore a hoodie to hide skin flare-ups in school. Now he’s an artist and advocate helping others feel seen. He reflects on his psoriasis journey, the power of small joys, and why loving yourself first isn’t a cliché—it’s essential. Plus, a deep dive into the history of La Roche-Posay’s legendary spring. See omnystudio.com/listener for privacy information.…

about a year ago 12:46

MP3•Episode home

We define multi good factor authentication, which is the idea that not all authentication factors are equal. We discuss the importance of considering authentication strength and the contextual nature of trust.

517 episodes

Root Causes 484: Multi Good Factor Authentication

Root Causes: A PKI and Security Podcast

published about a year ago

MP3•Episode home

517 episodes

#Tech #Tim Callan #Jason Soroko

All episodes

1
Root Causes 516: PQC for ADCS 13:39

1 day ago13:39

13:39

Microsoft has finally announced that it will offer an update to Active Directory Certificate Services (ADCS, formerly MSCA) to support post quantum cryptography. We discuss Microsoft's checkered support for ADCS and offer some questions users should be asking.

1
Root Causes 515: What Is Entropy-aware Governance? 14:51

4 days ago14:51

14:51

Jason coins the term "entropy-aware governance" to describe the idea of using the degree of entropy it contains to measure the strength of any given secret. This could be an objective, consistent metric that could be applied to standard practices and requirements.

1
Root Causes 514: Diary of an Online Firestorm 12:45

6 days ago12:45

12:45

Tim describes how the addition of an item to the CABF face-to-face meeting agenda blew up into a panicked and outraged online thread. We discuss what a more functional response would have looked like.

1
Root Causes 513: Is Revocation the Best Remedy for CPS Misalignment? 12:21

8 days ago12:21

12:21

We continue our discussion of CPS misalignment by discussing the reasons for revocation as a remedy, its disadvantages, and the possibility of another solution that provides the same benefits at less cost.

1
Root Causes 512: CPS Versus Practices Misalignment 12:41

11 days ago12:41

12:41

We examine the circumstance where otherwise allowed practices are out of alignment with the stated practices in the relevant CPS. We discuss CA transparency and accountability, increased scrutiny of the CPS, and mass revocation.

1
Root Causes 511: The GoML Root Store 15:41

17 days ago15:41

15:41

We follow up on our discussion of the Get off My Lawn (GoTM) browser with Jason's adventure in creating his own custom root store.

1
Root Causes 510: Introducing the GoML Browser 10:18

26 days ago10:18

10:18

We discuss Jason's code vibing journey to create the Get Off My Lawn! (GoTM) browser. We discuss SSL certificate information, EV indicators, and cookie handling.

1
Root Causes 509: What Is a CPS? 7:30

27 days ago7:30

7:30

We define CPS (Certificate Practices Statement) and explain the role it plays in both the WebPKI and private CAs.

1
Root Causes 508: What Is Code Vibing? 17:43

29 days ago17:43

17:43

"Code vibing" is using generative AI to create or improve working code. We share Jason's adventure using code vibing to create his own web browser.

1
Root Causes 507: First Distrust of 2025 9:32

5 weeks ago9:32

9:32

The first CA distrust event of 2025 comes with two simultaneous CA distrusts. We give you the details.

1
Root Causes 506: Recap of CABF Face-to-face #65 8:53

5 weeks ago8:53

8:53

For the first time ever, Jason and I record an episode from the floor of the CA/Browser Forum face-to-face meeting. We recap the themes of this meeting, and Jason gives his first impressions of a CABF Face-to-face.

1
Root Causes 505: Trust Now, Forge Later 10:33

6 weeks ago10:33

10:33

In this episode we explain the potential for future quantum computers to break files signed today with RSA or ECC, called "Trust now, forge later."

1
Root Causes 504: Jason Programs a Quantum Computer 17:48

6 weeks ago17:48

17:48

Jason describes his recent experience using Amazon Braket.

1
Root Causes 503: What Are Hybrid and Composite PQC? 8:03

7 weeks ago8:03

8:03

We explain the difference between two strategies of PQC implementation, which we call hybrid and composite.

1
Root Causes 502: The PQC Game of Chicken 10:59

7 weeks ago10:59

10:59

In this episode Jason explains the fallacy of "playing chicken" with the Quantum Apocalypse. We discuss stack ranking and "eyes open" PQC risk decisions.

Root Causes: A PKI and Security Podcast

1
Root Causes 501: Why Increasing RSA Key Size Won't Solve the Quantum Problem 3:35

7 weeks ago3:35

3:35

In this brief episode we explain why the problem that Shor's Algorithm poses to RSA and ECC can't be solved simply by increasing key size.

Root Causes: A PKI and Security Podcast

1
Root Causes 500: OMG! 500 Episodes of Root Causes! 20:46

8 weeks ago20:46

20:46

Wow. It's episode 500 of Root Causes. Jason and Tim talk about how the podcast has evolved in the past six years, how it remains consistent, and the updates we're making to keep being a valuable resource for our listeners.

Root Causes: A PKI and Security Podcast

1
Root Causes 499: Don't Blame Signal 8:37

8 weeks ago8:37

8:37

The recent Signal controversy highlights the importance of understanding what protections an E2EE messaging app provides, and what it does not.

Root Causes: A PKI and Security Podcast

1
Root Causes 498: UK NCSC PQC Guidance 15:31

9 weeks ago15:31

15:31

The UK National Cyber Security Centre (NCSC) has released new PQC guidance. We take exception to the dates it gives and explain why.

Root Causes: A PKI and Security Podcast

1
Root Causes 497: PQC Update with Sofia Celi 19:50

9 weeks ago19:50

19:50

Guest Sofia Celi (IETF, Brave) returns to talk about important developments in post quantum cryptography. Sofia tells us about her candidate algorithm MAYO and what is happening with the NIST PQC onramp. We learn about KEM TLS and the status of PQC initiatives in IETF.

Root Causes: A PKI and Security Podcast

1
Root Causes 496: E2EE Gmail 12:26

9 weeks ago12:26

12:26

Gmail is now end-to-end encrypted for all recipients, regardless of the receiving client. We explain how Gmail accomplishes this trick.

Root Causes: A PKI and Security Podcast

1
Root Causes 495: Trust Models and Post Quantum Cryptography 7:00

10 weeks ago7:00

7:00

We build on our Trust Models discussion to explore how organizations can structure their PKI for the transition to post quantum cryptography (PQC).

Root Causes: A PKI and Security Podcast

1
Root Causes 494: Introduction to Trust Models 21:09

10 weeks ago21:09

21:09

We explain the basics of trust models and compare various models including WebPKI, private CA, and consortium models.

Root Causes: A PKI and Security Podcast

1
Root Causes 493: Disentangling Public and Private Certificate Use Cases 12:10

11 weeks ago12:10

12:10

Changing root store requirements mean CAs must separate their root hierarchies for different certificate types. We explain why enterprises should consider private CA for some use cases.

Root Causes: A PKI and Security Podcast

1
Root Causes 492: When Mandatory Security Training Sucks 19:36

11 weeks ago19:36

19:36

In this episode we get excited about errors we see in mandatory security trainings.

Root Causes: A PKI and Security Podcast

1
Root Causes 491: RSA's Non-quantum Threat 31:41

12 weeks ago31:41

31:41

We are rejoined by Dr. Michele Mosca to explore the potential threat of RSA being broken even in the absence of a quantum computing attack.

Root Causes: A PKI and Security Podcast

1
Root Causes 490: Chrome and Chromium 10:02

12 weeks ago10:02

10:02

We define Chrome versus Chromium, explaining what each is and the difference between the two.

Root Causes: A PKI and Security Podcast

1
Root Causes 489: Does AI Nullify E2EE? 12:04

13 weeks ago12:04

12:04

Does AI kill end-to-end encryption? There is a contention that the presence of AI agents in the workstream will render your confidential information visible outside the encrypted communication channels and therefore that E2EE is pointless. We explore this argument.

Root Causes: A PKI and Security Podcast

1
Root Causes 488: CABF Face-to-Face Meeting Update 5:37

13 weeks ago5:37

5:37

We explain the major news items from the most recent CA/Browser Forum face-to-face meeting in Tokyo. Topics include MPIC, 47-day certificate term, and Temporary Restraining Orders.

Root Causes: A PKI and Security Podcast

1
Root Causes 487: Security 2030 46:40

14 weeks ago46:40