4 ms·

I sometimes wonder why we don't just skip the CA layer entirely and let the browsers be the CAs. Buy a "mozilla cert" and an "IE cert" and a "Chrome cert", and

I sometimes wonder why we don't just skip the CA layer entirely and let the browsers be the CAs. Buy a "mozilla cert" and an "IE cert" and a "Chrome cert", and all the derivatives of them can hitch a ride based on that. It would fund browser development and eliminate the steaming pile of misplaced trust that is the PKI system. Sometime last year I deleted my CA certificates because I finally realized I'm never going to actually audit all of the certs in there, and I know there are confirmed bad actors among them, so I shouldn't give myself a false sense of security.

542458 10y ago
Hm. That's an interesting idea, since browser vendors have more incentive to maintain a good brand than random CAs that most people have never heard of. My big concern is browsers effectively would have a monopoly over their users (in theory users can switch but in practice most wouldn't), meaning that browsers could dramatically overcharge for their certs. I wouldn't be worried about, say, Mozilla, but some other vendors might not play nice...
- kardos 10y ago
  Well, also it would divide their focus between producing excellent browsers and bureaucratic certificate details. I think it would make more sense to create another non-profit variant of Let's Encrypt for EV certs.
- bandrami 10y ago
  browsers effectively would have a monopoly over their users Sure, and there's already such a troublingly small vendor's market to begin with (Microsoft, Google, Mozilla, really). This idea would definitely have problems, but then again so does what we're doing now...
  - snovv_crash 10y ago
    And Apple, since you can't replace mobile Safari, just reskin it.
- bandrami 10y ago
  Also I think your incentives point is interesting. Right now the auditors (the CAs) are being paid by the auditees for the auditing. Wall Street a decade ago shows us what's wrong with that. If we want to get the incentives right we need a way for CAs to get most of their money from the certs' clients rather than from those who deploy them.

542458 10y ago

Hm. That's an interesting idea, since browser vendors have more incentive to maintain a good brand than random CAs that most people have never heard of. My big concern is browsers effectively would have a monopoly over their users (in theory users can switch but in practice most wouldn't), meaning that browsers could dramatically overcharge for their certs. I wouldn't be worried about, say, Mozilla, but some other vendors might not play nice...

kardos 10y ago
Well, also it would divide their focus between producing excellent browsers and bureaucratic certificate details. I think it would make more sense to create another non-profit variant of Let's Encrypt for EV certs.
bandrami 10y ago
browsers effectively would have a monopoly over their users Sure, and there's already such a troublingly small vendor's market to begin with (Microsoft, Google, Mozilla, really). This idea would definitely have problems, but then again so does what we're doing now...
- snovv_crash 10y ago
  And Apple, since you can't replace mobile Safari, just reskin it.
bandrami 10y ago
Also I think your incentives point is interesting. Right now the auditors (the CAs) are being paid by the auditees for the auditing. Wall Street a decade ago shows us what's wrong with that. If we want to get the incentives right we need a way for CAs to get most of their money from the certs' clients rather than from those who deploy them.