5 ms·

How long until Google becomes an authority and just starts handing out SSL certificates for free? Doesn't this sound like something they would already be doing

• windsurfer 17y ago
  Would Microsoft accept a Google-signed certificate? Would Microsoft pre-install such certificates by default?
  • dangrossman 17y ago
    Is there some reason Microsoft would not want to accept a Google signed certificate?
    • tptacek 17y ago
      Is there some reason Microsoft would want to accept a Google root certificate?
      • ars 17y ago
        Regulatory or consumer pressure. The desire to not have the appearance of anti-competitive actions.
        • tptacek 17y ago
          ... are fuzzy arguments that will be torpedoed by any weal security argument Microsoft deploys against them. Turn this over on its head. What about Mozilla accepting a Microsoft-run CA?
          • blasdel 17y ago
            I really hope they would -- it'd be extremely nice for vanilla Windows Server installs to be able to provision themselves a default certificate. Of course, Mozilla are the asshats that innovated the draconian dialog maze for self-signed certificates, and as such have made it impossible to ship appliances with HTTPS web interfaces. I hope their heads fall off. Don't you really want WiFi access point config pages to be HTTPS-only?
            • tptacek 17y ago
              In my experience, Mozilla comes in for the harshest criticism from the people who understand TLS the least.
              • cpach 17y ago
                What's the argument? That Mozilla makes it too hard to use self-signed certs?
                • tptacek 17y ago
                  Yep.
            • windsurfer 17y ago
              I think it's great that Mozilla made it difficult to use self-signed certs. Most people don't use them correctly, and making self-signed essentially off limits to people is a great increase in security. You should try using ettercap. It's surprisingly easy to intercept all traffic going to and from a self-signed site.
              • ars 17y ago
                It's easy to use ettercap to mount a man-in-the-middle attack? Self-signed certs are only vulnerable to mitm attacks, but don't most network topologies make doing that pretty hard?
                • tptacek 17y ago
                  No. Anyone who can see a DNS query can hijack traffic.
      • deleted 17y ago
        [deleted]
• mey 17y ago
  Google will most likely be a CA on Chrome OS systems and Android systems eventually.