7 ms·

I have no love for most the major CAs I've interacted with, but this feels wrong, though I can't quite pin point why. Perhaps just a general feeling that all t

I have no love for most the major CAs I've interacted with, but this feels wrong, though I can't quite pin point why. Perhaps just a general feeling that all the internet eggs are being put, one by one, in one single alphabet basket.

satai 10y ago
Let's hope they stick to publishing all certificates into the certificate transparency list (Merkle tree).
- noinsight 10y ago
  They should be - they're making certificate transparency logs mandatory in 2017 [1]. [1] https://casecurity.org/2016/11/08/google-certificate-transparency-ct-to-expand-to-all-certificates-types/ https://casecurity.org/2016/11/08/google-certificate-transpa...
zokier 10y ago
As far as I can tell, this is more like Goog gathering their own eggs in their own basket. They are becoming more and more self-sufficient, but don't really seem that interested in taking over the whole market. As long as it stays that way, I don't mind much.
- serge2k 10y ago
  They have the most popular browser, mobile OS, search engine. They operate popular public DNS servers too. They add this cert and they control a vast chunk of the internet.
  - zokier 10y ago
    This is different from all the things you mentioned by the virtue of not offering CA services to anyone (except themselves). So they are not really entering/disrupting any new market with this move.
  - dx034 10y ago
    But there's no real lock-in effect. It's very easy to switch search engines, but rarely anyone does it because Google's simply better than Bing. If someone else comes up with better algorithms I'm sure that people would start switching. But very few people switch just to avoid the monopolist. Same for Google Chrome. Switching to another browser is a matter of a few minutes (including taking the data with you). But as long as Chrome is at least as good as the others, there's no reason to do so. I think it's important to recognize the differences between monopolists with lock-in (e.g. Microsoft with Windows and Office) and those without lock-in. Even though I'm also concerned about the amount of data that Google has, I'm sure they'll at some point end up like Yahoo or AOL. The question only is how long it takes. IMO Microsoft is only around because they could generate revenues from lock-in effects during years where their new products were really bad. They've caught up now and did a lot right in the last years (and already benefit from it financially). But if they'd only had a portfolio like Google, I'm not sure they would still play a role.
    - hobarrera 10y ago
      > If someone else comes up with better algorithms I'm sure that people would start switching. DDG has yielded results far superior to google years (IMHO, this is a bit subjective), but I don't see people moving over because google is simply "what they know". A better alternative won't make people move, they need further motivation.
- inopinatus 10y ago
  Ponder the meaning of the words in the title: The foundation of a more secure web. There's a clear implication of using market power to exercise universal control, and (as we've seen with email & browsers) this is not a new behaviour for Google.
JoshTriplett 10y ago
> this feels wrong, though I can't quite pin point why. It's unusual for a root CA to be run by a service that otherwise has nothing to do with CA issuance, for the primary purpose of issuing certificates for that service's first-party sites, and not for third-party sites. I can't think of a single other example of a single-purpose root CA like this. (The announcement mentions that they might use this to operate as a CA for third-party sites as well, but right now it exists to certify first-party sites.)
- niels_olson 10y ago
  > I can't think of a single other example of a single-purpose CA like this. Department of Defense: http://www.disa.mil/enterprise-services/identity-and-access-management/pki-pke http://www.disa.mil/enterprise-services/identity-and-access-...
  - rmhrisk 10y ago
    There are numerous, Microsoft has its own subordinate CA that they operate for their own certificates. Amazon has its own root CA https://www.amazontrust.com/repository/ https://www.amazontrust.com/repository/. There are more as well.
    - inopinatus 10y ago
      Amazon is using their CA for issuing customer ELB/Cloudfront certificates, not just their own stuff, and not even all of it: the cert I see at https://amazon.com's https://amazon.com's is Symantec-issued.
- algesten 10y ago
  I guess if NSA/FBI forces google to hand over the CA keys, they kan orchestrate undetectable MITM-attacks. I wonder why browser won't automatically store the fingerprint for every HTTPS-certificate it encounters and throw up a fuzz to the user if a certificate changes without any good reason?
  - 10y ago
crdoconnor 10y ago
If they use their browser dominance to gain the upper hand in the certificate issuance market that seems like a violation of anti-trust law.
- chc 10y ago
  If they use their data centers to imprison detractors, that also sounds illegal. It doesn't make data centers sketchy on their own, though.
scalio 10y ago
I guess I'm not the only one who's noticed the steady stream of "Do x with google" on the frontpage. This is what's unsettling me, they seem to want to seep into every last crack of our lives, starting with all things web. Edit: At least it felt like a slow stream to me. Search isn't being very cooperative towards my cause right now... The only item matching my memory is https://news.ycombinator.com/item?id=13013494 https://news.ycombinator.com/item?id=13013494 , but I'll be damned if there weren't others.
- dx034 10y ago
  On the other hand, they still lag behind Microsoft and Amazon when it comes to cloud efforts. Yes, they clearly dominate search and ads, but the topics discussed here are mostly cloud-services related. And there, most is done via AWS and increasingly also via Azure (esp. enterprises). Google Cloud doesn't dominate that in any way.
tyingq 10y ago
They control a popular public dns server, a CA, a global local cache, and control over the most popular browser and phone. They have all the pieces to do almost seamless MITM. "We see you haven't signed up yet for AMP, so we've done the work for you" Yes, I get they wouldn't do this, but the fact that they could is a little scary.
- imatworkyo 10y ago
  whats even more scary, is Google being able to tell what site is valid/secure. Imagine the implications if they limited who could get CA's or decided the information on your site was harmful

satai 10y ago

Let's hope they stick to publishing all certificates into the certificate transparency list (Merkle tree).

noinsight 10y ago
They should be - they're making certificate transparency logs mandatory in 2017 [1]. [1] https://casecurity.org/2016/11/08/google-certificate-transparency-ct-to-expand-to-all-certificates-types/ https://casecurity.org/2016/11/08/google-certificate-transpa...

zokier 10y ago

As far as I can tell, this is more like Goog gathering their own eggs in their own basket. They are becoming more and more self-sufficient, but don't really seem that interested in taking over the whole market. As long as it stays that way, I don't mind much.

serge2k 10y ago
They have the most popular browser, mobile OS, search engine. They operate popular public DNS servers too. They add this cert and they control a vast chunk of the internet.
- zokier 10y ago
  This is different from all the things you mentioned by the virtue of not offering CA services to anyone (except themselves). So they are not really entering/disrupting any new market with this move.
- dx034 10y ago
  But there's no real lock-in effect. It's very easy to switch search engines, but rarely anyone does it because Google's simply better than Bing. If someone else comes up with better algorithms I'm sure that people would start switching. But very few people switch just to avoid the monopolist. Same for Google Chrome. Switching to another browser is a matter of a few minutes (including taking the data with you). But as long as Chrome is at least as good as the others, there's no reason to do so. I think it's important to recognize the differences between monopolists with lock-in (e.g. Microsoft with Windows and Office) and those without lock-in. Even though I'm also concerned about the amount of data that Google has, I'm sure they'll at some point end up like Yahoo or AOL. The question only is how long it takes. IMO Microsoft is only around because they could generate revenues from lock-in effects during years where their new products were really bad. They've caught up now and did a lot right in the last years (and already benefit from it financially). But if they'd only had a portfolio like Google, I'm not sure they would still play a role.
  - hobarrera 10y ago
    > If someone else comes up with better algorithms I'm sure that people would start switching. DDG has yielded results far superior to google years (IMHO, this is a bit subjective), but I don't see people moving over because google is simply "what they know". A better alternative won't make people move, they need further motivation.
inopinatus 10y ago
Ponder the meaning of the words in the title: The foundation of a more secure web. There's a clear implication of using market power to exercise universal control, and (as we've seen with email & browsers) this is not a new behaviour for Google.

JoshTriplett 10y ago

> this feels wrong, though I can't quite pin point why. It's unusual for a root CA to be run by a service that otherwise has nothing to do with CA issuance, for the primary purpose of issuing certificates for that service's first-party sites, and not for third-party sites. I can't think of a single other example of a single-purpose root CA like this. (The announcement mentions that they might use this to operate as a CA for third-party sites as well, but right now it exists to certify first-party sites.)

niels_olson 10y ago
> I can't think of a single other example of a single-purpose CA like this. Department of Defense: http://www.disa.mil/enterprise-services/identity-and-access-management/pki-pke http://www.disa.mil/enterprise-services/identity-and-access-...
- rmhrisk 10y ago
  There are numerous, Microsoft has its own subordinate CA that they operate for their own certificates. Amazon has its own root CA https://www.amazontrust.com/repository/ https://www.amazontrust.com/repository/. There are more as well.
  - inopinatus 10y ago
    Amazon is using their CA for issuing customer ELB/Cloudfront certificates, not just their own stuff, and not even all of it: the cert I see at https://amazon.com's https://amazon.com's is Symantec-issued.
algesten 10y ago
I guess if NSA/FBI forces google to hand over the CA keys, they kan orchestrate undetectable MITM-attacks. I wonder why browser won't automatically store the fingerprint for every HTTPS-certificate it encounters and throw up a fuzz to the user if a certificate changes without any good reason?
- 10y ago

crdoconnor 10y ago

If they use their browser dominance to gain the upper hand in the certificate issuance market that seems like a violation of anti-trust law.

chc 10y ago
If they use their data centers to imprison detractors, that also sounds illegal. It doesn't make data centers sketchy on their own, though.

scalio 10y ago

I guess I'm not the only one who's noticed the steady stream of "Do x with google" on the frontpage. This is what's unsettling me, they seem to want to seep into every last crack of our lives, starting with all things web. Edit: At least it felt like a slow stream to me. Search isn't being very cooperative towards my cause right now... The only item matching my memory is https://news.ycombinator.com/item?id=13013494 https://news.ycombinator.com/item?id=13013494 , but I'll be damned if there weren't others.

dx034 10y ago
On the other hand, they still lag behind Microsoft and Amazon when it comes to cloud efforts. Yes, they clearly dominate search and ads, but the topics discussed here are mostly cloud-services related. And there, most is done via AWS and increasingly also via Azure (esp. enterprises). Google Cloud doesn't dominate that in any way.

tyingq 10y ago

They control a popular public dns server, a CA, a global local cache, and control over the most popular browser and phone. They have all the pieces to do almost seamless MITM. "We see you haven't signed up yet for AMP, so we've done the work for you" Yes, I get they wouldn't do this, but the fact that they could is a little scary.

imatworkyo 10y ago
whats even more scary, is Google being able to tell what site is valid/secure. Imagine the implications if they limited who could get CA's or decided the information on your site was harmful