4 ms·

Really, either way, this is a death sentence for Wosign/Startcom. They're unlikely to survive for a year + all of the time and cost it would take to recertify w

Really, either way, this is a death sentence for Wosign/Startcom. They're unlikely to survive for a year + all of the time and cost it would take to recertify without any revenue from certificate issuance. Insta-revocation therefore wouldn't really make this notably more painful for them -- they're walking dead at this point either way and there's a good chance they may even close shop before the deadline. All it would do is immediately put a bunch of their innocent customers in immediate pain, for essentially no gain. It might also send the message to, say, Symantec, that they can get away with anything, because no browser would risk revoking 30+% of the web instantly. Establishing a procedure that allows for executing a CA of any size puts everyone on notice.

tptacek 10y ago
It's worse even than that, because a substantial portion of their customer base will need to renew during the year, and will switch to new CAs. Not only do they forgo a year of revenue, but they also begin the next year with a substantially reduced customer base.
- 0x0 10y ago
  Is that why they apparently have started handing out free 3 year certificates?
- dankohn1 10y ago
  I really appreciate the analysis. However, can WoSign resell a different CA's services for the next year without their customers noticing?
  - pas 10y ago
    Sure, why not. A lot of "CAs" do this.
mtgx 10y ago
> They're unlikely to survive for a year Well, they might, unless the other browser vendors do the same. Firefox is only like 10% of the total browser market (mobile included).
- roblabla 10y ago
  AFAIK, moz's CA isn't just for FF. On linux, the default "root CA" used by google chrome is mozilla's NSS as shown here[0]. Also, other root certificate programs may follow suit. [0]: https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...
- tempestn 10y ago
  Even if other browsers don't follow suit, 10% is enough for effectively no one to choose their certificates. When there are other, even free, alternatives, why would anyone voluntarily give up 10% of their potential users?
- Xylakant 10y ago
  Browser shares vary wildly by country. For example in germany FF is still the widest used desktop browser. Including mobile probably tips it in favor of safari or chrome, but losing a substantial portion of the desktop market in Europe's largest economy will hurt you.
  - paulasmuth 10y ago
    >> For example in germany FF is still the widest used desktop browser. Do you have any references to back that up? I'm asking because I suspect your assumption is completely wrong. (Based on a bunch of analytics data that I have access to, which might not be representative but still contains some very large german web properties, chrome has more than twice the market share compared to FF in germany).
    - seren 10y ago
      Not sure how accurate it is but this shows that FF is still the first desktop browser (but not for long it seems) in Germany: http://gs.statcounter.com/#browser-DE-monthly-201508-201608 http://gs.statcounter.com/#browser-DE-monthly-201508-201608 On the other hand if you only look at mobile, Chrome is well ahead of everything else: http://gs.statcounter.com/#mobile_browser-DE-monthly-201508-201608 http://gs.statcounter.com/#mobile_browser-DE-monthly-201508-...
AndyMcConachie 10y ago
There's no guarantee their suspension will only last a year. They have to go through the normal Mozilla inclusion process and a bunch of extra hoops to get re-trusted. I think you're calling them walking dead pretty well nails it. Their smartest move right now might be to close up shop and walk away.

tptacek 10y ago

It's worse even than that, because a substantial portion of their customer base will need to renew during the year, and will switch to new CAs. Not only do they forgo a year of revenue, but they also begin the next year with a substantially reduced customer base.

0x0 10y ago
Is that why they apparently have started handing out free 3 year certificates?
dankohn1 10y ago
I really appreciate the analysis. However, can WoSign resell a different CA's services for the next year without their customers noticing?
- pas 10y ago
  Sure, why not. A lot of "CAs" do this.

mtgx 10y ago

> They're unlikely to survive for a year Well, they might, unless the other browser vendors do the same. Firefox is only like 10% of the total browser market (mobile included).

roblabla 10y ago
AFAIK, moz's CA isn't just for FF. On linux, the default "root CA" used by google chrome is mozilla's NSS as shown here[0]. Also, other root certificate programs may follow suit. [0]: https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...
tempestn 10y ago
Even if other browsers don't follow suit, 10% is enough for effectively no one to choose their certificates. When there are other, even free, alternatives, why would anyone voluntarily give up 10% of their potential users?
Xylakant 10y ago
Browser shares vary wildly by country. For example in germany FF is still the widest used desktop browser. Including mobile probably tips it in favor of safari or chrome, but losing a substantial portion of the desktop market in Europe's largest economy will hurt you.
- paulasmuth 10y ago
  >> For example in germany FF is still the widest used desktop browser. Do you have any references to back that up? I'm asking because I suspect your assumption is completely wrong. (Based on a bunch of analytics data that I have access to, which might not be representative but still contains some very large german web properties, chrome has more than twice the market share compared to FF in germany).
  - seren 10y ago
    Not sure how accurate it is but this shows that FF is still the first desktop browser (but not for long it seems) in Germany: http://gs.statcounter.com/#browser-DE-monthly-201508-201608 http://gs.statcounter.com/#browser-DE-monthly-201508-201608 On the other hand if you only look at mobile, Chrome is well ahead of everything else: http://gs.statcounter.com/#mobile_browser-DE-monthly-201508-201608 http://gs.statcounter.com/#mobile_browser-DE-monthly-201508-...

AndyMcConachie 10y ago

There's no guarantee their suspension will only last a year. They have to go through the normal Mozilla inclusion process and a bunch of extra hoops to get re-trusted. I think you're calling them walking dead pretty well nails it. Their smartest move right now might be to close up shop and walk away.