6 ms·

Why on earth should any CA be getting involved in what a site hosts? They need to validate ownership and stop.

by MichaelGG 11y ago

ikeboy 11y ago
If a site is blatantly criminal, should a CA revoke its cert?
- jqm 11y ago
  No. Separation of concerns and all....
  - jrockway 11y ago
    I tend to agree. There is so much that SSL/TLS doesn't validate that I don't have a strong security expectation. The web server could be some pre-release accidentally pushed to production. The software I'm talking to on the other end could be bug central. The employees at the company could be untrustworthy. The site could be compromised. Someone could be sniffing traffic between frontends and backends ("SSL added and removed here! :-)") All the lock icon says is "someone who made a request to the CA controls the other end of the connection". Usually this means you aren't being MITM'd by one of your ISP's or WiFi hotspot's ad insertion proxies. That's about it. If the CAs start wanting to verify organization software engineering practices and issue different certificates based on the outcome of the audit, that's fine. But that's not my current expectation.
- MichaelGG 11y ago
  A: Seems like they got it wrong here if that was indeed their reason. That alone is good enough to say no. B: Criminal for who? I certainly don't want Geotrust deciding what's allowed. Does that mean they can e.g. block sites donating to Wikileaks?
  - ikeboy 11y ago
    B: criminal in that country. If donating to Wikileaks was declared illegal in the US (it hasn't), then I'd be fine with Geotrust revoking certs for websites blatantly violating that.
    - meric 11y ago
      What if it is declared illegal by the DOJ and declared legal by one of the lower level courts, and there is an appeal by the DOJ? Is it legal or illegal then?
      - ikeboy 11y ago
        There's a reason I said "blatantly illegal". If there's a dispute, it's not blatant.
    - thanksgiving 11y ago
      Does Geotrust then accept full legal responsibility of guaranteeing that the contents of a site is legal in the US? If we find cp on a site with a Geotrust SSL certificates, will we send the Geotrust board to prison for it? If the answer is no, then they cannot do what you said.
      - ikeboy 11y ago
        If the answer is no, then they cannot do what you said. Uh, no. Plenty of companies already censor certain content without accepting liability for parts that they miss. There is no law preventing a company from not hosting content they find problematic, whether it's illegal or for any other reason. That doesn't give up their protection under DMCA. (CAs wouldn't even need DMCA, because they aren't hosting content or redistributing it). Similarly, there is no law I know of that would disallow a CA from revoking a cert they issued. Maybe breach of contract, but generally their terms will prohibit illegal activities, so the other side will have breached contract first.
        thanksgiving 11y ago
- bandrami 11y ago
  No. Why would they? The certificate simply guarantees that it is in fact that criminal with whom you are communicating. And there are perfectly valid reasons one might want to communicate with a criminal.
  - ikeboy 11y ago
    >No. Why would they? Because they don't want to do business with a criminal.
    - fredkbloggs 11y ago
      > Because they don't want to do business with a criminal. I don't either, most of the time. But verifying a certificate is the equivalent of checking someone's ID to make sure the name matches the face. It doesn't tell me whether someone is a criminal, nor do I expect it to. If it's that important to me, I'll check their ID and then head to the county courthouse to check public records before agreeing to anything. Whether someone is a criminal, what kind of criminal, and how recently are both too much data and too perishable and uncertain to put on someone's ID card. Which is why that's not done in most (any?) jurisdictions.
      - ikeboy 11y ago
        >But verifying a certificate is the equivalent of checking someone's ID to make sure the name matches the face. But CAs aren't government entities (well, some are, but that's besides the point). There's no right to get a cert. This is the equivalent of a private company issuing ID cards, and deciding that they'll stop issuing cards to anyone who uses the cards for illegal activities.
        jqm 11y ago
        You keep making it out like they suspended individual certs. That would have been bad enough but it isn't what happened. They revoked all certs including those they had previously sold (with certain implied expectations) to people (such as myself) who were not engaged in any illicit activity. They didn't even inform me before hand and I only found out when clients were unable to conduct their business through my app. I actually had to track the source of the problem down... because they were too lazy to inform me after being too lazy to only suspend offending certs in the first place and inconsiderate enough of their commitments and my business to honer the certs for the period they had taken money for rather than simply declining to further sell certs for this TLD. It caused me a good deal of hassle. Not enough of a hassle to sue, that isn't an option, but what they did is quite egregious and is, at very minimum laziness and bad business and up a level unethical and borderline scummy. They might, by some twisted definition, have a legal "right" to do this but they are still assholes and people should probably refrain from doing business with them.
- jbb555 11y ago
  No of course not. The certificate is to prove ownership, nothing more. Criminal activity doesn't alter that. There are other laws to cover that.
djrogers 11y ago
This wasn't even a single site - it was an entire TLD that got revoked. There's no excuse for that kind of action unless the private key for that TLD was compromised. Breach notification in 3..2..1...
- 0x0 11y ago
  In the current SSL system there is no such concept as a "private key for a TLD". Every single one of the roots can sign anything. :(
  - deleted 11y ago
    [deleted]
  - cldellow 11y ago
    Some browsers do restrict CAs, see e.g. http://googleonlinesecurity.blogspot.ca/2013/12/further-improving-digital-certificate.html http://googleonlinesecurity.blogspot.ca/2013/12/further-impr...
    - 0x0 11y ago
      So a CA got caught red-handed having issued an intermediate CA that spoofed google domains ... and instead of throwing them out of the CA club, their response was to reluctantly limit them to *.fr and 12 other TLDs? Explain why they aren't permanently blacklisted and banned from ever being in the root store for any purpose again???
- kpcyrd 11y ago
  Certification is tld agnostic. The only plausible reason to revoke certs by tld would be an error in the dns root for .pw, which would be bad for a company that verifies domain ownership as a business.
beefsack 11y ago
What has happened here feels very similar to vigilantism.

Why on earth should any CA be getting involved in what a site hosts? They need to validate ownership and stop.

ikeboy 11y ago

If a site is blatantly criminal, should a CA revoke its cert?

jqm 11y ago
No. Separation of concerns and all....
- jrockway 11y ago
  I tend to agree. There is so much that SSL/TLS doesn't validate that I don't have a strong security expectation. The web server could be some pre-release accidentally pushed to production. The software I'm talking to on the other end could be bug central. The employees at the company could be untrustworthy. The site could be compromised. Someone could be sniffing traffic between frontends and backends ("SSL added and removed here! :-)") All the lock icon says is "someone who made a request to the CA controls the other end of the connection". Usually this means you aren't being MITM'd by one of your ISP's or WiFi hotspot's ad insertion proxies. That's about it. If the CAs start wanting to verify organization software engineering practices and issue different certificates based on the outcome of the audit, that's fine. But that's not my current expectation.
MichaelGG 11y ago
A: Seems like they got it wrong here if that was indeed their reason. That alone is good enough to say no. B: Criminal for who? I certainly don't want Geotrust deciding what's allowed. Does that mean they can e.g. block sites donating to Wikileaks?
- ikeboy 11y ago
  B: criminal in that country. If donating to Wikileaks was declared illegal in the US (it hasn't), then I'd be fine with Geotrust revoking certs for websites blatantly violating that.
  - meric 11y ago
    What if it is declared illegal by the DOJ and declared legal by one of the lower level courts, and there is an appeal by the DOJ? Is it legal or illegal then?
    - ikeboy 11y ago
      There's a reason I said "blatantly illegal". If there's a dispute, it's not blatant.
  - thanksgiving 11y ago
    Does Geotrust then accept full legal responsibility of guaranteeing that the contents of a site is legal in the US? If we find cp on a site with a Geotrust SSL certificates, will we send the Geotrust board to prison for it? If the answer is no, then they cannot do what you said.
    - ikeboy 11y ago
      If the answer is no, then they cannot do what you said. Uh, no. Plenty of companies already censor certain content without accepting liability for parts that they miss. There is no law preventing a company from not hosting content they find problematic, whether it's illegal or for any other reason. That doesn't give up their protection under DMCA. (CAs wouldn't even need DMCA, because they aren't hosting content or redistributing it). Similarly, there is no law I know of that would disallow a CA from revoking a cert they issued. Maybe breach of contract, but generally their terms will prohibit illegal activities, so the other side will have breached contract first.
      - thanksgiving 11y ago
bandrami 11y ago
No. Why would they? The certificate simply guarantees that it is in fact that criminal with whom you are communicating. And there are perfectly valid reasons one might want to communicate with a criminal.
- ikeboy 11y ago
  >No. Why would they? Because they don't want to do business with a criminal.
  - fredkbloggs 11y ago
    > Because they don't want to do business with a criminal. I don't either, most of the time. But verifying a certificate is the equivalent of checking someone's ID to make sure the name matches the face. It doesn't tell me whether someone is a criminal, nor do I expect it to. If it's that important to me, I'll check their ID and then head to the county courthouse to check public records before agreeing to anything. Whether someone is a criminal, what kind of criminal, and how recently are both too much data and too perishable and uncertain to put on someone's ID card. Which is why that's not done in most (any?) jurisdictions.
    - ikeboy 11y ago
      >But verifying a certificate is the equivalent of checking someone's ID to make sure the name matches the face. But CAs aren't government entities (well, some are, but that's besides the point). There's no right to get a cert. This is the equivalent of a private company issuing ID cards, and deciding that they'll stop issuing cards to anyone who uses the cards for illegal activities.
      - jqm 11y ago
        You keep making it out like they suspended individual certs. That would have been bad enough but it isn't what happened. They revoked all certs including those they had previously sold (with certain implied expectations) to people (such as myself) who were not engaged in any illicit activity. They didn't even inform me before hand and I only found out when clients were unable to conduct their business through my app. I actually had to track the source of the problem down... because they were too lazy to inform me after being too lazy to only suspend offending certs in the first place and inconsiderate enough of their commitments and my business to honer the certs for the period they had taken money for rather than simply declining to further sell certs for this TLD. It caused me a good deal of hassle. Not enough of a hassle to sue, that isn't an option, but what they did is quite egregious and is, at very minimum laziness and bad business and up a level unethical and borderline scummy. They might, by some twisted definition, have a legal "right" to do this but they are still assholes and people should probably refrain from doing business with them.
jbb555 11y ago
No of course not. The certificate is to prove ownership, nothing more. Criminal activity doesn't alter that. There are other laws to cover that.

djrogers 11y ago

This wasn't even a single site - it was an entire TLD that got revoked. There's no excuse for that kind of action unless the private key for that TLD was compromised. Breach notification in 3..2..1...

0x0 11y ago
In the current SSL system there is no such concept as a "private key for a TLD". Every single one of the roots can sign anything. :(
- deleted 11y ago
  [deleted]
- cldellow 11y ago
  Some browsers do restrict CAs, see e.g. http://googleonlinesecurity.blogspot.ca/2013/12/further-improving-digital-certificate.html http://googleonlinesecurity.blogspot.ca/2013/12/further-impr...
  - 0x0 11y ago
    So a CA got caught red-handed having issued an intermediate CA that spoofed google domains ... and instead of throwing them out of the CA club, their response was to reluctantly limit them to *.fr and 12 other TLDs? Explain why they aren't permanently blacklisted and banned from ever being in the root store for any purpose again???
kpcyrd 11y ago
Certification is tld agnostic. The only plausible reason to revoke certs by tld would be an error in the dns root for .pw, which would be bad for a company that verifies domain ownership as a business.

beefsack 11y ago

What has happened here feels very similar to vigilantism.