3 ms·

No, the only thing the CA vouches for is that the other party is who they claim to be, which 99% of the time doesn't matter because I don't trust who they claim

No, the only thing the CA vouches for is that the other party is who they claim to be, which 99% of the time doesn't matter because I don't trust who they claim to be any more than I trust someone impersonating who they claim to be.

tptacek 10y ago
I'm still lost. What do you think it is that Comodo is vouching for with Hacker News?
- bandrami 10y ago
  That the person who received the certificate from them was in control of the domain (for some definition of "control" that meets Comodo's standards) at the time the certificate was issued. I've never tried to get a wildcard from Comodo, personally, but since there's no O section of the certificate I assume Comodo didn't do anything beyond "do you control the DNS" or "do you control certain email addresses". This is at least less wasteful of time and effort on everybody's part than Comodo verifying that a specific company or person was actually involved; again, I don't trust ycombinator any more than I trust someone impersonating ycombinator, so any 3rd party verification is kind of pointless to me.
jrochkind1 10y ago
How can the CA be _more_ trustworthy as to whether the other party is really Bank of America... than Bank of America itself is? I don't understand your argument, and I think it's a novel interpretation of the CA infrastruture, I think whatever threats you are considering (that Bank of America would intentionally lie about what website is a Bank of America website?) is not something the CA infrastructure was designed to protect against or is capable of protecting against. If authorized Bank of America staff is committed to claiming some website is Bank of America, they can get it trusted as Bank of America by a third-party CA too, can't they? I think by definition any website that authorized Bank of America agents claim is a Bank of America website, _is_ a Bank of America website. That's all it means to be "really" a BoA website, to be a website BoA intentionally meant to represent BoA. I don't think the CA infrastructure can possibly defend against authorized Bank of America agents claiming a website is a BoA website when you think they were wrong to claim that. The CA infrastructure is meant to guarantee that the website was intentionally authorized by Bank of America to be a Bank of America website -- that's it. It doesn't even always do that securely because of flaws, but it never does any more than that. Am I missing something?

tptacek 10y ago

I'm still lost. What do you think it is that Comodo is vouching for with Hacker News?

bandrami 10y ago
That the person who received the certificate from them was in control of the domain (for some definition of "control" that meets Comodo's standards) at the time the certificate was issued. I've never tried to get a wildcard from Comodo, personally, but since there's no O section of the certificate I assume Comodo didn't do anything beyond "do you control the DNS" or "do you control certain email addresses". This is at least less wasteful of time and effort on everybody's part than Comodo verifying that a specific company or person was actually involved; again, I don't trust ycombinator any more than I trust someone impersonating ycombinator, so any 3rd party verification is kind of pointless to me.

jrochkind1 10y ago

How can the CA be _more_ trustworthy as to whether the other party is really Bank of America... than Bank of America itself is? I don't understand your argument, and I think it's a novel interpretation of the CA infrastruture, I think whatever threats you are considering (that Bank of America would intentionally lie about what website is a Bank of America website?) is not something the CA infrastructure was designed to protect against or is capable of protecting against. If authorized Bank of America staff is committed to claiming some website is Bank of America, they can get it trusted as Bank of America by a third-party CA too, can't they? I think by definition any website that authorized Bank of America agents claim is a Bank of America website, _is_ a Bank of America website. That's all it means to be "really" a BoA website, to be a website BoA intentionally meant to represent BoA. I don't think the CA infrastructure can possibly defend against authorized Bank of America agents claiming a website is a BoA website when you think they were wrong to claim that. The CA infrastructure is meant to guarantee that the website was intentionally authorized by Bank of America to be a Bank of America website -- that's it. It doesn't even always do that securely because of flaws, but it never does any more than that. Am I missing something?