3 ms·

Is it broken when a CA can be compromised without consequence? Is it broken when bad actors can have root certs installed in most browsers? Yes, it's broken. I

Is it broken when a CA can be compromised without consequence? Is it broken when bad actors can have root certs installed in most browsers? Yes, it's broken. It's been broken for a very long time.

rtpg 11y ago
but all decentralised proposals I've ever seen fall over at scale, or become basically the CA system when applied at a big enough scale. I would like to be pointed out to be wrong here, though. the current CA system bugs me for the "one CA compromised" aspect.
- arpa 11y ago
  What about DANE? I would imagine it has potential to do away with CA...
  - icebraining 11y ago
    https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html
    - arpa 11y ago
      Well that definitely answers my question. Thank you. What about something like certificate blockchain? e.g. https://github.com/okTurtles/dnschain https://github.com/okTurtles/dnschain
      - hannob 11y ago
        It already exists and is called Certificate Transparency: https://www.certificate-transparency.org/ https://www.certificate-transparency.org/
        arpa 11y ago
        holy sh*t it's learning day today! Thanks!
deleted 11y ago
[deleted]
cm2187 11y ago
In a way it's broken for the same reason than the banking system was: too big to fail. So many websites rely on a few CA that we can't allow to fail, otherwise we break the internet. I wonder if we shouldn't adopt a solution similar to what was adopted for banks: a plan for orderly failure. Having a protocole, at least for DV certificates, to easily switch all your website to another CA. All CA would have to implement the same API, and all web servers would be able to consume that API. The same API would be used for auto-renewing certificates. Effectively generalising let's encrypt for commercial certificates.
- realusername 11y ago
  A protocol should definitely be in place for that, all the updates I do are handled just by using apt-get except for certificates. Like I don't want to handle myself anything related to certificates (including the list of ciphers, the generation of new certificates, the compromised CAs ...), the current certificate system feels like the equivalent of installing updates with .tar.gz archives.
- icebraining 11y ago
  I think that's one of the goals of Let's Encrypt, by developing the ACME protocol, which will be submitted as a standard RFC: https://ietf-wg-acme.github.io/acme/ https://ietf-wg-acme.github.io/acme/

Is it broken when a CA can be compromised without consequence? Is it broken when bad actors can have root certs installed in most browsers? Yes, it's broken. It's been broken for a very long time.

rtpg 11y ago

but all decentralised proposals I've ever seen fall over at scale, or become basically the CA system when applied at a big enough scale. I would like to be pointed out to be wrong here, though. the current CA system bugs me for the "one CA compromised" aspect.

arpa 11y ago
What about DANE? I would imagine it has potential to do away with CA...
- icebraining 11y ago
  https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html
  - arpa 11y ago
    Well that definitely answers my question. Thank you. What about something like certificate blockchain? e.g. https://github.com/okTurtles/dnschain https://github.com/okTurtles/dnschain
    - hannob 11y ago
      It already exists and is called Certificate Transparency: https://www.certificate-transparency.org/ https://www.certificate-transparency.org/
      - arpa 11y ago
        holy sh*t it's learning day today! Thanks!

deleted 11y ago

[deleted]

cm2187 11y ago

In a way it's broken for the same reason than the banking system was: too big to fail. So many websites rely on a few CA that we can't allow to fail, otherwise we break the internet. I wonder if we shouldn't adopt a solution similar to what was adopted for banks: a plan for orderly failure. Having a protocole, at least for DV certificates, to easily switch all your website to another CA. All CA would have to implement the same API, and all web servers would be able to consume that API. The same API would be used for auto-renewing certificates. Effectively generalising let's encrypt for commercial certificates.

realusername 11y ago
A protocol should definitely be in place for that, all the updates I do are handled just by using apt-get except for certificates. Like I don't want to handle myself anything related to certificates (including the list of ciphers, the generation of new certificates, the compromised CAs ...), the current certificate system feels like the equivalent of installing updates with .tar.gz archives.
icebraining 11y ago
I think that's one of the goals of Let's Encrypt, by developing the ACME protocol, which will be submitted as a standard RFC: https://ietf-wg-acme.github.io/acme/ https://ietf-wg-acme.github.io/acme/