4 ms·
You may not be able to immediately spot a bad CA, but the more major CAs buy in to CT, the easier it is to spot fraudulent certs through fingerprint reporting.
by ak217 10y ago
You may not be able to immediately spot a bad CA, but the more major CAs buy in to CT, the easier it is to spot fraudulent certs through fingerprint reporting. SSL clients can then choose to have a side-channel trust revocation mechanism. Once adoption snowballs, the overall level of trust in the system will rise.
The other problem is that CAs need to be regionally confined in which TLD CNs they can issue certs for.
- geofft 10y ago> The other problem is that CAs need to be regionally confined in which TLD CNs they can issue certs for. Ryan Sleevi makes a good argument here about why that's bad policy for the internet: https://groups.google.com/d/msg/mozilla.dev.security.policy/pF4aVsF21ww/31qQd3i0ulIJ https://groups.google.com/d/msg/mozilla.dev.security.policy/... There are some good arguments in both directions on that thread. I do happen to like the world in which, say, Let's Encrypt is capable of issuing for any TLD. If we don't think WoSign is good enough for signing .com, we probably shouldn't be exposing .cn users to those attacks, either.
- ak217 10y agoI find the arguments from "it's wrong to recognize borders on the Internet" a bit naive, or impractical. The borders recognize us, and state-sponsored attacks will continue, and have very far-reaching implications. We need better tools to fight them, including this one. I like the discussion in that thread about how to make the scheme reasonably flexible, though. Thanks for the link.