5 ms·
The bullshit the CAs pull never ceases to amaze me.
by Fej 10y ago
The bullshit the CAs pull never ceases to amaze me.
- throwanem 10y agoComodo in particular has a long history of shady bullshit. Tarring all CAs with that brush strikes me as unduly harsh.
- hobs 10y agoWhile its fair to say that some CA's are not scum, so many of them have done shady things, and they are basically rent seekers for a product that they spend little on to verify things like identity etc. Most certs are just money printing machines for the orgs in charge of them and I am not surprised they would want to fight back against LE.
- JoshTriplett 10y agoSee also "Chromodo", the Chrome fork by Comodo that introduces such incredible security features as turning off the same-origin policy, completely breaking the Internet security model.
- vox_mollis 10y agoIndeed. Their PCI-DSS compliance scanning service is completely useless. Service version fingerprinting only, regardless of binary patch level or actual vulns. Yet somehow, the PCI SSC accepts their scan results as actionable for Level 1-3 compliance.
- throwanem 10y agoPCI verification is a rubber stamp all the way through, is how.
- Kadin 10y ago> Tarring all CAs with that brush strikes me as unduly harsh. While I'm sure there are CAs who aren't as egregiously bad as Comodo, it's hard to get around the fact that they basically shouldn't exist as a class, and any CA that isn't working to put itself out of business is sort of hurting the Internet ecosystem.
- kelukelugames 10y agoWhat does CA mean in this context?
- incongruity 10y agoAnd that's a bit ironic, given that we rely on them for part of the foundation of internet security... just say'n is all.
- imglorp 10y agoCAs charge so much and offer so little value at such high risk. Comodo has already been subverted once before. Another reason to use distributed identity. Donated to Let's Encrypt.
- zeveb 10y agoThe entire CA model is fundamentally broken: I rely on an entity I have no relationship to vouch for entities it has a relationship with. That makes no sense. The way it should work is that I rely on an entity I do have a relationship with to vouch for entities. Could be public, could be private (I'd prefer private, since that would make resiliency, competition & experimentation more likely).
- icebraining 10y agoTechnically, you have a relationship: you have their certificate in your computer for your browser to validate against. You can remove it and/or add others. The problem is that a single entity can vouch for each site, so if you don't want to trust it, you can't validate the site at all. Moxie's Convergence[¹] proposal - like Carnegie Mellon's Perspectives Project before - avoids this problem by allowing many entities to vouch for the same site. [1] https://en.wikipedia.org/wiki/Convergence_%28SSL%29 https://en.wikipedia.org/wiki/Convergence_%28SSL%29