5 ms·

If they're not trustworthy, let's remove them from the trusted CA lists of major FOSS browsers / distros. Anyone know the proper mailing list / bugtracker this

by csense 10y ago

If they're not trustworthy, let's remove them from the trusted CA lists of major FOSS browsers / distros. Anyone know the proper mailing list / bugtracker this should be filed on in the case of Firefox?

zymhan 10y ago
While a worthy cause, Firefox would be utterly broken if Comodo was no longer a trusted CA.
- giancarlostoro 10y ago
  Just how many use Comodo, and why isn't there some sort of movement pushing against Comodo? Hopefully if they lose business or start to they will think twice and attempt to restructure everything.
  - pfg 10y ago
    CloudFlare uses them for Universal SSL, so that's roughly 5% of all websites[1]. Their overall market share (in the CA business) appears to be around 40%[2]. [1]: https://w3techs.com/technologies/details/cn-cloudflare/all/all https://w3techs.com/technologies/details/cn-cloudflare/all/a... [2]: https://w3techs.com/technologies/overview/ssl_certificate/all https://w3techs.com/technologies/overview/ssl_certificate/al...
    - giancarlostoro 10y ago
      Oh, CloudFlare uses them. That's quite a market share. It is sad that they have such a bad reputation... Hopefully someone buys them out who restructures them or something....
      - porpoisemonkey 10y ago
        An alternative option is to petition CloudFlare to switch Certificate Authorities and hit Comodo where it hurts - in their wallet.
  - wigam 10y ago
    Hacker news uses Comodo as their CA.
    - giancarlostoro 10y ago
      I didn't even notice. I guess they're a bigger fish than I ever realized.
    - nojvek 10y ago
      At least hn should switch to letsencrypt after the douchebaggery from comodo.
- happyslobro 10y ago
  Sounds like we need a new type of TLS warning: > While this site's certificate is technically valid, it was issued by an untrustworthy (citation) agency (link to Comodo).
  - type0 10y ago
    Awesome idea, couple years ago I dropped the few certs I had with Comodo after all their malpractices. This should be included as a warning for every website that has their cert: https://en.wikipedia.org/wiki/Comodo_Group#Controversies https://en.wikipedia.org/wiki/Comodo_Group#Controversies
    - i336_ 10y ago
      Followup idea: a trusted neutral 3rd party that ranks CAs by various factors, such as controversiality. Quotes Wikipedia and other (arguably) objective sources [of fact] and welcomes debate about potential bias. Perhaps this group could publish reports periodically so that they can then be picked up and bundled into browsers - that way you're not constantly sending [trackable] cert requests to a 3rd party, and you already have the cert info so there's no query server to DDoS. Maybe Firefox could incorporate it into the TLS info popup and possibly the HTTPS icon... Chrome never would; this idea goes way too close to the advertising industry. An extension would be nice, but something like this would never go viral so would never get adoption. Native browser integration would be a must. Also, mozilla.org's cert is by DigiCert. What's their track record?

by csense 10y ago

zymhan 10y ago

While a worthy cause, Firefox would be utterly broken if Comodo was no longer a trusted CA.

giancarlostoro 10y ago
Just how many use Comodo, and why isn't there some sort of movement pushing against Comodo? Hopefully if they lose business or start to they will think twice and attempt to restructure everything.
- pfg 10y ago
  CloudFlare uses them for Universal SSL, so that's roughly 5% of all websites[1]. Their overall market share (in the CA business) appears to be around 40%[2]. [1]: https://w3techs.com/technologies/details/cn-cloudflare/all/all https://w3techs.com/technologies/details/cn-cloudflare/all/a... [2]: https://w3techs.com/technologies/overview/ssl_certificate/all https://w3techs.com/technologies/overview/ssl_certificate/al...
  - giancarlostoro 10y ago
    Oh, CloudFlare uses them. That's quite a market share. It is sad that they have such a bad reputation... Hopefully someone buys them out who restructures them or something....
    - porpoisemonkey 10y ago
      An alternative option is to petition CloudFlare to switch Certificate Authorities and hit Comodo where it hurts - in their wallet.
- wigam 10y ago
  Hacker news uses Comodo as their CA.
  - giancarlostoro 10y ago
    I didn't even notice. I guess they're a bigger fish than I ever realized.
  - nojvek 10y ago
    At least hn should switch to letsencrypt after the douchebaggery from comodo.
happyslobro 10y ago
Sounds like we need a new type of TLS warning: > While this site's certificate is technically valid, it was issued by an untrustworthy (citation) agency (link to Comodo).
- type0 10y ago
  Awesome idea, couple years ago I dropped the few certs I had with Comodo after all their malpractices. This should be included as a warning for every website that has their cert: https://en.wikipedia.org/wiki/Comodo_Group#Controversies https://en.wikipedia.org/wiki/Comodo_Group#Controversies
  - i336_ 10y ago
    Followup idea: a trusted neutral 3rd party that ranks CAs by various factors, such as controversiality. Quotes Wikipedia and other (arguably) objective sources [of fact] and welcomes debate about potential bias. Perhaps this group could publish reports periodically so that they can then be picked up and bundled into browsers - that way you're not constantly sending [trackable] cert requests to a 3rd party, and you already have the cert info so there's no query server to DDoS. Maybe Firefox could incorporate it into the TLS info popup and possibly the HTTPS icon... Chrome never would; this idea goes way too close to the advertising industry. An extension would be nice, but something like this would never go viral so would never get adoption. Native browser integration would be a must. Also, mozilla.org's cert is by DigiCert. What's their track record?