3 ms·
Hm. That's an interesting idea, since browser vendors have more incentive to maintain a good brand than random CAs that most people have never heard of. My big
by 542458 10y ago
Hm. That's an interesting idea, since browser vendors have more incentive to maintain a good brand than random CAs that most people have never heard of.
My big concern is browsers effectively would have a monopoly over their users (in theory users can switch but in practice most wouldn't), meaning that browsers could dramatically overcharge for their certs. I wouldn't be worried about, say, Mozilla, but some other vendors might not play nice...
- kardos 10y agoWell, also it would divide their focus between producing excellent browsers and bureaucratic certificate details. I think it would make more sense to create another non-profit variant of Let's Encrypt for EV certs.
- bandrami 10y agobrowsers effectively would have a monopoly over their users Sure, and there's already such a troublingly small vendor's market to begin with (Microsoft, Google, Mozilla, really). This idea would definitely have problems, but then again so does what we're doing now...
- snovv_crash 10y agoAnd Apple, since you can't replace mobile Safari, just reskin it.
- bandrami 10y agoAlso I think your incentives point is interesting. Right now the auditors (the CAs) are being paid by the auditees for the auditing. Wall Street a decade ago shows us what's wrong with that. If we want to get the incentives right we need a way for CAs to get most of their money from the certs' clients rather than from those who deploy them.