4 ms·

So maybe the CA should not proactively do anything but rather await a court order to disrupt their customer's service? I would be completely OK with disruption

So maybe the CA should not proactively do anything but rather await a court order to disrupt their customer's service? I would be completely OK with disruption if service after a court order that requires it. I am not OK with proactive and speculative shutdown of service (even with "infallible" evidence, it still remains proactive and speculative until the clients are proven guilty of illegal activities in court). ikeboy 3 minutes ago > I'm fine with a CA doing that. I'm also fine with them choosing to revoke specific certs after deciding those are clearly illegal. If they are later shown to be legal, then sue the CA for breach of contract or whatever. > If you were a CA, and people were using your certs for a cp site or trading in stolen credit cards, how would you like being told you couldn't revoke the cert unless some court asked you to? I'd tell them that I'm not responsible for what my clients do or don't do. The CA root supply isn't big enough for the Free market to do is job by itself.

ikeboy 11y ago
I'm fine with a CA doing that. I'm also fine with them choosing to revoke specific certs after deciding those are clearly illegal. If they are later shown to be legal, then sue the CA for breach of contract or whatever. If you were a CA, and people were using your certs for a cp site or trading in stolen credit cards, how would you like being told you couldn't revoke the cert unless some court asked you to? >I'd tell them that I'm not responsible for what my clients do or don't do. Hm, I wonder how well the media will take that ...
- fredkbloggs 11y ago
  We already have a mechanism for determining that something is illegal, called the criminal justice system. We don't need every private company in the world passing its own judgment on that with respect to its customers, employees, or anyone else. It is highly unlikely that even the largest and most diligent corporation is going to be as effective at that as the public system, despite the latter's flaws. Centuries (millennia, really) of experience and billions of dollars go into solving this problem. If you're not satisfied with that solution, we need to improve it, not reimplement it badly in 50,000 different places.
  - ikeboy 11y ago
    So what exactly are you proposing? Should companies be banned from enforcing their own standards? Should every company be required to treat any and all customers alike, without doing a "legal risk analysis", because that prejudges the law?
    - thanksgiving 11y ago
      Ban is a strong word. What I'm saying is that if I were a CA, it is against my interest to project the idea that I take proactive effort against my customers. I'm warmer to the idea of being picky on which clients to take but even that is a picky topic. Like you said, it doesn't matter what is legal. Media will have a field day talking about my CA should someone like Ashley Madison be my client. But that's just the beginning. There will be cases against me because well f#$% me, right? I mean I took steps in case A and was unable tondonsonin case B. It doesn't matter if the case has no merit. If there are enough of them, it still distracts me significantly from my job. At least that's my perspective. I've never run a CA so I'm sure I don't understand the subtleties but the way I understsnd it, perhaps CAs would be better served to restrict themselves to authentication. Now, that's not to say that CAs should do nothing. For example, if your own private keys are compromised I can imagine a scenario where you'd move quickly to invalidate everything underneath. But I guess these are technical and security reasons not fear of a media backlash.
      - ikeboy 11y ago
        What I'm saying is that if I were a CA, it is against my interest to project the idea that I take proactive effort against my customers. That's fine. It's also fine for another CA to analyse the situation and come to a different conclusion.
    - fredkbloggs 11y ago
      If that's the only alternative to what's happening today, yes. It's not a practical solution, because there are many reasons a supplier might not want a particular piece of business, some of which are not harmful (lack of resources, customer with dubious credit, etc). But the arrogance of prejudging the law is very dangerous to free expression, especially when the vendor is a monopolist or oligopolist, as is the case with CAs. That danger is multiplied further when the scope of the judgment is widened beyond whether the vendor's (always overly conservative) lawyers suggest the company might be liable as a criminal accomplice if it accepted the business. It's becoming quite common for corporations to refuse to serve any customer, or to employ any person, that is not 100% inoffensive to 100% of the population. The slightest hint of controversy or any public (or often, sadly, private) statement that falls outside the Overton Window will result in being cut off. If you ask a corporate lawyer whether serving a particular customer is risky, you will always be told yes, no matter who it is. So allowing their involvement in that decision is problematic, regardless of the nominal reason offered for turning away business. I don't know whether that's what happened here, because we don't have any kind of announcement, just an anecdote and some supposition. But I would be willing to take some pretty strong measures to make sure it can't. Extending common-carrier status to CAs would be a very modest and narrow place to start, but I would take this much farther, to the very outer edge of what's practical. The world is a horribly stifling place as it is; we don't need corporations contributing to the problem, especially since they are ill-equipped to determine whether something is illegal and will invariably default to the most conservative position.

ikeboy 11y ago

I'm fine with a CA doing that. I'm also fine with them choosing to revoke specific certs after deciding those are clearly illegal. If they are later shown to be legal, then sue the CA for breach of contract or whatever. If you were a CA, and people were using your certs for a cp site or trading in stolen credit cards, how would you like being told you couldn't revoke the cert unless some court asked you to? >I'd tell them that I'm not responsible for what my clients do or don't do. Hm, I wonder how well the media will take that ...

fredkbloggs 11y ago
We already have a mechanism for determining that something is illegal, called the criminal justice system. We don't need every private company in the world passing its own judgment on that with respect to its customers, employees, or anyone else. It is highly unlikely that even the largest and most diligent corporation is going to be as effective at that as the public system, despite the latter's flaws. Centuries (millennia, really) of experience and billions of dollars go into solving this problem. If you're not satisfied with that solution, we need to improve it, not reimplement it badly in 50,000 different places.
- ikeboy 11y ago
  So what exactly are you proposing? Should companies be banned from enforcing their own standards? Should every company be required to treat any and all customers alike, without doing a "legal risk analysis", because that prejudges the law?
  - thanksgiving 11y ago
    Ban is a strong word. What I'm saying is that if I were a CA, it is against my interest to project the idea that I take proactive effort against my customers. I'm warmer to the idea of being picky on which clients to take but even that is a picky topic. Like you said, it doesn't matter what is legal. Media will have a field day talking about my CA should someone like Ashley Madison be my client. But that's just the beginning. There will be cases against me because well f#$% me, right? I mean I took steps in case A and was unable tondonsonin case B. It doesn't matter if the case has no merit. If there are enough of them, it still distracts me significantly from my job. At least that's my perspective. I've never run a CA so I'm sure I don't understand the subtleties but the way I understsnd it, perhaps CAs would be better served to restrict themselves to authentication. Now, that's not to say that CAs should do nothing. For example, if your own private keys are compromised I can imagine a scenario where you'd move quickly to invalidate everything underneath. But I guess these are technical and security reasons not fear of a media backlash.
    - ikeboy 11y ago
      What I'm saying is that if I were a CA, it is against my interest to project the idea that I take proactive effort against my customers. That's fine. It's also fine for another CA to analyse the situation and come to a different conclusion.
  - fredkbloggs 11y ago
    If that's the only alternative to what's happening today, yes. It's not a practical solution, because there are many reasons a supplier might not want a particular piece of business, some of which are not harmful (lack of resources, customer with dubious credit, etc). But the arrogance of prejudging the law is very dangerous to free expression, especially when the vendor is a monopolist or oligopolist, as is the case with CAs. That danger is multiplied further when the scope of the judgment is widened beyond whether the vendor's (always overly conservative) lawyers suggest the company might be liable as a criminal accomplice if it accepted the business. It's becoming quite common for corporations to refuse to serve any customer, or to employ any person, that is not 100% inoffensive to 100% of the population. The slightest hint of controversy or any public (or often, sadly, private) statement that falls outside the Overton Window will result in being cut off. If you ask a corporate lawyer whether serving a particular customer is risky, you will always be told yes, no matter who it is. So allowing their involvement in that decision is problematic, regardless of the nominal reason offered for turning away business. I don't know whether that's what happened here, because we don't have any kind of announcement, just an anecdote and some supposition. But I would be willing to take some pretty strong measures to make sure it can't. Extending common-carrier status to CAs would be a very modest and narrow place to start, but I would take this much farther, to the very outer edge of what's practical. The world is a horribly stifling place as it is; we don't need corporations contributing to the problem, especially since they are ill-equipped to determine whether something is illegal and will invariably default to the most conservative position.