zlacker

Is there any proof that most others store their certificates on hardware?

>>pintxo+(OP)
Hardware tokens are mandated for EV code signing certificates[1], but not for regular certificates. However, the certificate was from a while ago so that requirement probably wasn't a thing back then.

[1] https://www.digicert.com/signing/code-signing-certificates "REQUIRES TWO-FACTOR AUTHENTICATION USING HARDWARE TOKEN"

>>pintxo+(OP)
What gruez said is correct. Hardware token have been mandated for EV certificates for a long time by providers to prevent leaks.

I'll also add that Amazon Key Management Service, Azure Key Vault, and Google Key Management Service store several hundred million private keys combined with no leaks so far (they are non-exportable and access is audited)

It is very rare that we see malware signed by a publisher's certificate, which is why it is in the news every time it happens.

>>pintxo+(OP)
I bought a Windows EV code signing cert just months ago. It comes in the form of a password protected USB token.

>>Genbox+Xb
No leaks does not imply security.