3 ms·

> It should be notary publics (a business all about assurance of human identity) using a physical appliance. As an attorney, and notary public, I cannot begin

> It should be notary publics (a business all about assurance of human identity) using a physical appliance. As an attorney, and notary public, I cannot begin to explain to you how grossly misguided you are. The requirements to become a notary public are extraordinarily low. The notary public exam should be passable by someone with a tenth grade education. It substantially easier to become a notary public than to get a driver's license. https://www.nationalnotary.org/new-york#NYRequirements https://www.nationalnotary.org/new-york#NYRequirements Not to mention that any attorney admitted to the NY BAR can automatically become a notary without any further testing or requirement. I think it is probably safe to say that a single digit percentage of attorneys in NY state can even articulate what an SSL cert is, much less be trusted to issue them. A very substantial portion of admitted NY attorneys are routinely bested by their own email programs for pete's sake. This idea is wholly, entirely preposterous.

EdHominem 10y ago
Do you know the legal requirements to work in the certificate-granting department of a CA? There is no legal bar whatsoever. No bond, nothing. > I think it is probably safe to say that a single digit percentage of attorneys in NY state can even articulate what an SSL cert is, much less be trusted to issue them. Sure, and I don't even expect them to really know the details of a driver's license either. I only expect them to actually spend two minutes checking ID, photocopying the request, etc. With a physical appliance all they'd need to do would be lock it in a safe. > This idea is wholly, entirely preposterous. No, that's the certificate system in the first place. That a CA in China can sign a cert for a company in another country, etc.
- tialaramex 10y ago
  Although there are no _legal_ requirements, the root programmes (which bake these CAs into software like operating systems or web browsers) such as those from Mozilla, Microsoft, Apple, Google and Oracle get to impose requirements. All of them today require the CA/B Baseline Requirements plus whatever else takes their fancy. Issuing these certificates violates the Baseline Requirements, because the subscriber did not in fact have control of example.com, and probably not of these testN.com domains either How would your hypothetical New York attorney with an appliance in a safe validate control over the example.com name ? This is the Internet, nobody cares that you've shown some balding guy who works above a liquor store a fake driving license in the name Bob Smith - we need to know if you're really ycombinator.com or hsbc.com.hk or a-eon.biz and so the BRs require that Certificate Authorities have an effective way to validate that.
  - EdHominem 10y ago
    > How would your hypothetical New York attorney with an appliance in a safe validate control over the example.com name? By letting it connect to the internet and check for its challenge number on the target site. Also, I'm not imagining lawyers, but all notaries. I actually think a 7-11 clerk could handle the job. > All of them today require the CA/B Baseline Requirements plus whatever else takes their fancy. Issuing these certificates violates the Baseline Requirements, because the subscriber did not in fact have control of example.com, and probably not of these testN.com domains either Sorry, I missed the story about the bonded guy losing his million-dollar bond and not ever being allowed to have a similar job. They are bonded, right? Because if not all the yada yada is worthless. > This is the Internet, nobody cares that you've shown some balding guy who works above a liquor store a fake driving license in the name Bob Smith This is actually a large deterrent. Because of the notary actually checking ID you know you've got a picture of the bad guy. This is the part where we stop the attack from scaling. > - we need to know if you're really ycombinator.com or hsbc.com.hk or a-eon.biz and so the BRs require that Certificate Authorities have an effective way to validate that. Some things you say sound like you work in the industry, and some don't. Please describe the complicated cryptographic process you think a CA employee uses to personally verify ownership of a domain...
    - tialaramex 10y ago
      Such an appliance, able to make a determination regardless of its environment, does not and cannot exist. That's why our trust is in the humans, either individually (as in your system, no-one does this today) or as a corporate entity (that's how all the public CAs in existence today function). And those corporate entities (e.g. in this case the multi-billion dollar public company Symantec) are what's on the line when it comes to trust store sanctions. That's why Diginotar no longer exists, even though the Dutch Government tried to rescue it. (Side note: The person who originally started Diginotar was a notary...) and it's why StartCom / WoSign are probably screwed although they're limping along in the Chinese market for now. I have no idea why you think that seeing a fake ID helps "stop the attack from scaling". You don't have a photo of "the bad guy", you have a photo of somebody who did what they were asked for $20 and a packet of smokes. And again, validation is not a job for one individual, imaginary million dollar bonds don't make that any less true. Usually domain validation is automated, with the automation overseen by a group of employees, but even where it is not there will be pair reviews or group reviews so that no single person can bypass the system. Creating the right policies and enforcing them becomes a job for management, for company directors, and where appropriate for the shareholders. A CA must hire auditors to examine these processes. And the audits are reviewed by trust stores. The audits give us confidence that each CA has suitable policies in place to obey the BRs. I would like to see the auditors work directly for the trust stores, but the situation we have today is able to be effective. For example in the case of WoSign Mozilla told the auditing parent company - EY which used to be named Ernst & Young, a Big Four professional services company - that the branch used (EY Hong Kong) would no longer be accepted as an auditor by Mozilla because based on the available evidence its auditors either had colluded with WoSign / its CEO Richard Wang or were incompetent.

EdHominem 10y ago

Do you know the legal requirements to work in the certificate-granting department of a CA? There is no legal bar whatsoever. No bond, nothing. > I think it is probably safe to say that a single digit percentage of attorneys in NY state can even articulate what an SSL cert is, much less be trusted to issue them. Sure, and I don't even expect them to really know the details of a driver's license either. I only expect them to actually spend two minutes checking ID, photocopying the request, etc. With a physical appliance all they'd need to do would be lock it in a safe. > This idea is wholly, entirely preposterous. No, that's the certificate system in the first place. That a CA in China can sign a cert for a company in another country, etc.

tialaramex 10y ago
Although there are no _legal_ requirements, the root programmes (which bake these CAs into software like operating systems or web browsers) such as those from Mozilla, Microsoft, Apple, Google and Oracle get to impose requirements. All of them today require the CA/B Baseline Requirements plus whatever else takes their fancy. Issuing these certificates violates the Baseline Requirements, because the subscriber did not in fact have control of example.com, and probably not of these testN.com domains either How would your hypothetical New York attorney with an appliance in a safe validate control over the example.com name ? This is the Internet, nobody cares that you've shown some balding guy who works above a liquor store a fake driving license in the name Bob Smith - we need to know if you're really ycombinator.com or hsbc.com.hk or a-eon.biz and so the BRs require that Certificate Authorities have an effective way to validate that.
- EdHominem 10y ago
  > How would your hypothetical New York attorney with an appliance in a safe validate control over the example.com name? By letting it connect to the internet and check for its challenge number on the target site. Also, I'm not imagining lawyers, but all notaries. I actually think a 7-11 clerk could handle the job. > All of them today require the CA/B Baseline Requirements plus whatever else takes their fancy. Issuing these certificates violates the Baseline Requirements, because the subscriber did not in fact have control of example.com, and probably not of these testN.com domains either Sorry, I missed the story about the bonded guy losing his million-dollar bond and not ever being allowed to have a similar job. They are bonded, right? Because if not all the yada yada is worthless. > This is the Internet, nobody cares that you've shown some balding guy who works above a liquor store a fake driving license in the name Bob Smith This is actually a large deterrent. Because of the notary actually checking ID you know you've got a picture of the bad guy. This is the part where we stop the attack from scaling. > - we need to know if you're really ycombinator.com or hsbc.com.hk or a-eon.biz and so the BRs require that Certificate Authorities have an effective way to validate that. Some things you say sound like you work in the industry, and some don't. Please describe the complicated cryptographic process you think a CA employee uses to personally verify ownership of a domain...
  - tialaramex 10y ago
    Such an appliance, able to make a determination regardless of its environment, does not and cannot exist. That's why our trust is in the humans, either individually (as in your system, no-one does this today) or as a corporate entity (that's how all the public CAs in existence today function). And those corporate entities (e.g. in this case the multi-billion dollar public company Symantec) are what's on the line when it comes to trust store sanctions. That's why Diginotar no longer exists, even though the Dutch Government tried to rescue it. (Side note: The person who originally started Diginotar was a notary...) and it's why StartCom / WoSign are probably screwed although they're limping along in the Chinese market for now. I have no idea why you think that seeing a fake ID helps "stop the attack from scaling". You don't have a photo of "the bad guy", you have a photo of somebody who did what they were asked for $20 and a packet of smokes. And again, validation is not a job for one individual, imaginary million dollar bonds don't make that any less true. Usually domain validation is automated, with the automation overseen by a group of employees, but even where it is not there will be pair reviews or group reviews so that no single person can bypass the system. Creating the right policies and enforcing them becomes a job for management, for company directors, and where appropriate for the shareholders. A CA must hire auditors to examine these processes. And the audits are reviewed by trust stores. The audits give us confidence that each CA has suitable policies in place to obey the BRs. I would like to see the auditors work directly for the trust stores, but the situation we have today is able to be effective. For example in the case of WoSign Mozilla told the auditing parent company - EY which used to be named Ernst & Young, a Big Four professional services company - that the branch used (EY Hong Kong) would no longer be accepted as an auditor by Mozilla because based on the available evidence its auditors either had colluded with WoSign / its CEO Richard Wang or were incompetent.