7 ms·
The whole CA system should be abolished. The only thing needed is certificates for domain control, as LE does. We need one or two non-profit organizations for t
by onli 10y ago
The whole CA system should be abolished. The only thing needed is certificates for domain control, as LE does. We need one or two non-profit organizations for that who do that work transparently. Remove the market from where should be none.
- thesimon 10y ago>The only thing needed is certificates for domain control, as LE does EV certs are quite useful for special sites like banking though.
- creshal 10y agoWhy? As long as there's a single rogue CA that lets people print EV certs without due diligence, the whole system is a farce.
- verroq 10y agoNot with CT and pinning.
- mjevans 10y agoAt that point why have EV instead of actually doing real security and prompting the user to verify the certificate (and remembering what they approved)?
- thesimon 10y agoI don't think my mother knows how to verify the certificate and certificate chain.
- Kadin 10y agoUnless your mother knows not to go to a site without an EV certificate, it doesn't really matter that much. The certificate pinning is valuable in terms of preventing MITMs by rogue CAs, but the EV itself doesn't seem to really add much.
- stephenr 10y ago> Unless your mother knows not to go to a site without an EV certificate "Make sure it says <company name> in green at the top" is much easier than "ok now check any intermediary certs, and of course make sure they have the right fingerprint"
- Arnt 10y agoWhat we have is DANE and 0 nonprofits. Instead you add RRs in the domain (which you control, right?).
- drdaeman 10y ago> domain (which you control, right?) You never control a domain - ICANN, your TLD registry and your immediate domain registrar do. So, technically, it's just replacing one trust vector with another. However, given that we don't have a proper crypto in DNS (not even DNSSEC which many don't like and urge to abolish), it would be terrible. Anyone who can feed you spoofed DNS responses (i.e. starting from a cafe hotspot) would be able to impersonate just anything.
- okket 10y ago> You never control a domain Then don't use DNS if you can't trust it? You have to trust at some point. Or create your own infrastructure and convince others to trust you, if you want more than a private network. > Anyone who can feed you spoofed DNS responses The tendency goes towards running your own local DNS resolver. It was not possible in the 90s, but since then both the network and computer got a lot faster and smarter. DNSSEC has also evolved quite a bit and is the best we will get for long time. I really encourage to have a look again before dismissing it outright. http://blog.easydns.org/2015/08/06/for-dnssec/ http://blog.easydns.org/2015/08/06/for-dnssec/
- drdaeman 10y ago> Then don't use DNS if you can't trust it? Same with CAs, but I believe it's easier to distrust a rogue CA than a rogue name registry. I mean, if there's a news that some .example TLD is in bed with NSA, Chinese government and Russian FSB - there isn't much we can do about that, isn't it? And I guess most businesses won't go as far as changing their domain name. At the same time, on most devices I saw, distrusting a CA wasn't terribly complicated. And can be done by a browser or OS vendor, with a version upgrade, as well. > http://blog.easydns.org/2015/08/06/for-dnssec/ http://blog.easydns.org/2015/08/06/for-dnssec/ Thanks for the link. Looks like an interesting reading.