5 ms·

We've got a real too-big-to-fail going on here. If a little company screwed something up this badly they'd be dead. But when one the size of Symantec screws up

We've got a real too-big-to-fail going on here. If a little company screwed something up this badly they'd be dead. But when one the size of Symantec screws up - oh well they've got too many customers for us to revoke their signing privileges. It's a ridiculous system and fwiw, it shouldn't be the security companies (though that's being very polite to Symantec) that grant certificates. It should be notary publics (a business all about assurance of human identity) using a physical appliance. Or, admit we don't care and ditch the entire system for something based on bailing wire and chewing gum, because that's roughly what we've got now.

DiabloD3 10y ago
Except if Google decided to drop their certs, what Synmantec going to do? Sue? Google could be sued for leaving known insecure certs in Chrome.
- colechristensen 10y ago
  All google would have to do is warn that +1w all symc new certs will come with a yellow warning.
- EdHominem 10y ago
  Symantec can threaten larger lawsuits than you can, so we know how that'd come out. Also, and most critically, it's musical chairs between cloud and security companies. If Symantec came to Google to complain it's likely they'd go straight to VPs who used to work with them and get special treatment. Hence the call to use notaries. Let's avoid the whole buddy network.
mike-cardwell 10y ago
"they've got too many customers for us to revoke their signing privileges" We can however ban them from issuing any new certs. It wouldn't be the first time this has been done.
- dsp1234 10y ago
  https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...
libertymcateer 10y ago
> It should be notary publics (a business all about assurance of human identity) using a physical appliance. As an attorney, and notary public, I cannot begin to explain to you how grossly misguided you are. The requirements to become a notary public are extraordinarily low. The notary public exam should be passable by someone with a tenth grade education. It substantially easier to become a notary public than to get a driver's license. https://www.nationalnotary.org/new-york#NYRequirements https://www.nationalnotary.org/new-york#NYRequirements Not to mention that any attorney admitted to the NY BAR can automatically become a notary without any further testing or requirement. I think it is probably safe to say that a single digit percentage of attorneys in NY state can even articulate what an SSL cert is, much less be trusted to issue them. A very substantial portion of admitted NY attorneys are routinely bested by their own email programs for pete's sake. This idea is wholly, entirely preposterous.
- EdHominem 10y ago
  Do you know the legal requirements to work in the certificate-granting department of a CA? There is no legal bar whatsoever. No bond, nothing. > I think it is probably safe to say that a single digit percentage of attorneys in NY state can even articulate what an SSL cert is, much less be trusted to issue them. Sure, and I don't even expect them to really know the details of a driver's license either. I only expect them to actually spend two minutes checking ID, photocopying the request, etc. With a physical appliance all they'd need to do would be lock it in a safe. > This idea is wholly, entirely preposterous. No, that's the certificate system in the first place. That a CA in China can sign a cert for a company in another country, etc.
  - tialaramex 10y ago
    Although there are no _legal_ requirements, the root programmes (which bake these CAs into software like operating systems or web browsers) such as those from Mozilla, Microsoft, Apple, Google and Oracle get to impose requirements. All of them today require the CA/B Baseline Requirements plus whatever else takes their fancy. Issuing these certificates violates the Baseline Requirements, because the subscriber did not in fact have control of example.com, and probably not of these testN.com domains either How would your hypothetical New York attorney with an appliance in a safe validate control over the example.com name ? This is the Internet, nobody cares that you've shown some balding guy who works above a liquor store a fake driving license in the name Bob Smith - we need to know if you're really ycombinator.com or hsbc.com.hk or a-eon.biz and so the BRs require that Certificate Authorities have an effective way to validate that.

DiabloD3 10y ago

Except if Google decided to drop their certs, what Synmantec going to do? Sue? Google could be sued for leaving known insecure certs in Chrome.

colechristensen 10y ago
All google would have to do is warn that +1w all symc new certs will come with a yellow warning.
EdHominem 10y ago
Symantec can threaten larger lawsuits than you can, so we know how that'd come out. Also, and most critically, it's musical chairs between cloud and security companies. If Symantec came to Google to complain it's likely they'd go straight to VPs who used to work with them and get special treatment. Hence the call to use notaries. Let's avoid the whole buddy network.

mike-cardwell 10y ago

"they've got too many customers for us to revoke their signing privileges" We can however ban them from issuing any new certs. It wouldn't be the first time this has been done.

dsp1234 10y ago
https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...

libertymcateer 10y ago

> It should be notary publics (a business all about assurance of human identity) using a physical appliance. As an attorney, and notary public, I cannot begin to explain to you how grossly misguided you are. The requirements to become a notary public are extraordinarily low. The notary public exam should be passable by someone with a tenth grade education. It substantially easier to become a notary public than to get a driver's license. https://www.nationalnotary.org/new-york#NYRequirements https://www.nationalnotary.org/new-york#NYRequirements Not to mention that any attorney admitted to the NY BAR can automatically become a notary without any further testing or requirement. I think it is probably safe to say that a single digit percentage of attorneys in NY state can even articulate what an SSL cert is, much less be trusted to issue them. A very substantial portion of admitted NY attorneys are routinely bested by their own email programs for pete's sake. This idea is wholly, entirely preposterous.

EdHominem 10y ago
Do you know the legal requirements to work in the certificate-granting department of a CA? There is no legal bar whatsoever. No bond, nothing. > I think it is probably safe to say that a single digit percentage of attorneys in NY state can even articulate what an SSL cert is, much less be trusted to issue them. Sure, and I don't even expect them to really know the details of a driver's license either. I only expect them to actually spend two minutes checking ID, photocopying the request, etc. With a physical appliance all they'd need to do would be lock it in a safe. > This idea is wholly, entirely preposterous. No, that's the certificate system in the first place. That a CA in China can sign a cert for a company in another country, etc.
- tialaramex 10y ago
  Although there are no _legal_ requirements, the root programmes (which bake these CAs into software like operating systems or web browsers) such as those from Mozilla, Microsoft, Apple, Google and Oracle get to impose requirements. All of them today require the CA/B Baseline Requirements plus whatever else takes their fancy. Issuing these certificates violates the Baseline Requirements, because the subscriber did not in fact have control of example.com, and probably not of these testN.com domains either How would your hypothetical New York attorney with an appliance in a safe validate control over the example.com name ? This is the Internet, nobody cares that you've shown some balding guy who works above a liquor store a fake driving license in the name Bob Smith - we need to know if you're really ycombinator.com or hsbc.com.hk or a-eon.biz and so the BRs require that Certificate Authorities have an effective way to validate that.