5 ms·

Google's also been looking to limit the maximum validity lifetimes in general through the CA/B Forum[1] in a ballot that ended up not passing (with hints[2] tha

by lukegb 10y ago

Google's also been looking to limit the maximum validity lifetimes in general through the CA/B Forum[1] in a ballot that ended up not passing (with hints[2] that Chrome would end up enforcing something similar itself even if it wasn't part of the Baseline Requirements). This seems to be indicative of the general indication that Chrome wants to head in anyway[3]. [1] https://cabforum.org/pipermail/public/2017-January/009373.html https://cabforum.org/pipermail/public/2017-January/009373.ht... [2] https://cabforum.org/pipermail/public/2017-February/009746.html https://cabforum.org/pipermail/public/2017-February/009746.h... - there was a more explicit post elsewhere but I can't find it in the archives right now [3] https://twitter.com/sleevi_/status/829804370900426752 https://twitter.com/sleevi_/status/829804370900426752

zokier 10y ago
> with hints[2] that Chrome would end up enforcing something similar itself even if it wasn't part of the Baseline Requirements Kinda undermines the idea of having a standards group if Google is going to strongarm the industry by doing their own thing anyways
- dragonwriter 10y ago
  "Baseline Requirements" sort of implies that what is specified is minimum, rather than exhaustive, rules, and that specific applications will have additional rules.
  - tialaramex 10y ago
    And they all do. Mozilla's rules are public so you can go read them, and indeed you can help write them. But most famously they required all CAs to disclose loads of stuff, and they require CAs to do lots of stuff in public where everybody can see it, not behind closed doors where we don't know what they're up to. Google's rules include lots of stuff about their Certificate Transparency idea, which has helped no end. Microsoft's rules famously include them getting a veto where they can order any CA to revoke a certificate or else leave their trust programme. They mostly use this to zap malware / phishing sites. Apple's rules forbid having lots of roots at once. Although apparently this didn't apply to Symantec, or various other people. Huh.
- kibwen 10y ago
  > Kinda undermines the idea of having a standards group if Google is going to strongarm the industry by doing their own thing anyways In any industry where a single actor has a clear majority of the market share, you either vote with your feet (and implore all your friends to do so as well) to bring the powers back into equilibrium, or you cross your fingers and pray that Goliath is (and remains) benevolent.
- eli 10y ago
  You wouldn't want a standards group that somehow mandates all clients must accept all valid certs, right?
- ctz 10y ago
  The standards group in question is unfortunately impotent. Two totally reliable voting blocs: the browsers and the CAs. There are more CAs than browsers, so the result of every vote is in the favour of the CAs.
  - schoen 10y ago
    As was noted above, they have a constituency representation system so ballots have to pass with support from both constituencies, rather than an absolute majority of members.
- 762236 10y ago
  I expect the browser to look out for my interests as the user. How could the browser do that if it lets the CAs set the terms in the CAs' favor?
tialaramex 10y ago
Ballot 193 subseqently passed, limiting maximum (Web PKI) certificate lifetime to 825 days from March 2018. That's definitely not enough to keep Ryan Sleevi happy, but it may be enough to buy CAs a bit more breathing space.

by lukegb 10y ago

zokier 10y ago

> with hints[2] that Chrome would end up enforcing something similar itself even if it wasn't part of the Baseline Requirements Kinda undermines the idea of having a standards group if Google is going to strongarm the industry by doing their own thing anyways

dragonwriter 10y ago
"Baseline Requirements" sort of implies that what is specified is minimum, rather than exhaustive, rules, and that specific applications will have additional rules.
- tialaramex 10y ago
  And they all do. Mozilla's rules are public so you can go read them, and indeed you can help write them. But most famously they required all CAs to disclose loads of stuff, and they require CAs to do lots of stuff in public where everybody can see it, not behind closed doors where we don't know what they're up to. Google's rules include lots of stuff about their Certificate Transparency idea, which has helped no end. Microsoft's rules famously include them getting a veto where they can order any CA to revoke a certificate or else leave their trust programme. They mostly use this to zap malware / phishing sites. Apple's rules forbid having lots of roots at once. Although apparently this didn't apply to Symantec, or various other people. Huh.
kibwen 10y ago
> Kinda undermines the idea of having a standards group if Google is going to strongarm the industry by doing their own thing anyways In any industry where a single actor has a clear majority of the market share, you either vote with your feet (and implore all your friends to do so as well) to bring the powers back into equilibrium, or you cross your fingers and pray that Goliath is (and remains) benevolent.
eli 10y ago
You wouldn't want a standards group that somehow mandates all clients must accept all valid certs, right?
ctz 10y ago
The standards group in question is unfortunately impotent. Two totally reliable voting blocs: the browsers and the CAs. There are more CAs than browsers, so the result of every vote is in the favour of the CAs.
- schoen 10y ago
  As was noted above, they have a constituency representation system so ballots have to pass with support from both constituencies, rather than an absolute majority of members.
762236 10y ago
I expect the browser to look out for my interests as the user. How could the browser do that if it lets the CAs set the terms in the CAs' favor?

tialaramex 10y ago

Ballot 193 subseqently passed, limiting maximum (Web PKI) certificate lifetime to 825 days from March 2018. That's definitely not enough to keep Ryan Sleevi happy, but it may be enough to buy CAs a bit more breathing space.