5 ms·

I've often wondered: why is trust in CAs an all-or-nothing proposition (aside from EV certs), and why should my particular browser vendor have all the authority

I've often wondered: why is trust in CAs an all-or-nothing proposition (aside from EV certs), and why should my particular browser vendor have all the authority over who I should trust? For the vast majority of users that's probably just fine, but I would have thought that there'd be a browser or extension or something that allows security-conscious power users more fine-grained control over this by now. For example, I could subscribe to changes in CA trust levels from every major browser vendor, and if they don't agree my browser could show me a warning with an explanation. Or I could subscribe to feeds from other entities I trust, like the EFF. Or my security-conscious friends. Or if I decide I have lower trust in certificates issued by governmental CAs, or CAs in certain regions, I could mark them as lower trust. Basically a web of trust for CAs.

andrewfong 10y ago
> Or I could subscribe to feeds from other entities I trust, like the EFF. How would you validate that the EFF's feed is actually from the EFF? Assuming we're using existing SSL infrastructure, the browser would first need to trust the CA used by the EFF, which means we need an initial set of trusted CAs.
- jf 10y ago
  > which means we need an initial set of trusted CAs. How would you validate that the initial set of trusted CA roots is actually from those CAs?
  - inglor 10y ago
    It ships with your operating system, which you physically obtain from another computer (with hardware like a USB drive or via internal network).
    - tscs37 10y ago
      But how to trust that this other computer has a good set of CAs?
      - shawnz 10y ago
        How can you know your signing software is not backdoored? How can you know you're not living in a computer simulation?
        tscs37 10y ago
        Well, I'm certain my eyes are real so I am certainly not living in a computer simulation.
        iamatworknow 10y ago
        How Can Our CA Roots Be Real If Our Eyes Aren't Real https://twitter.com/officialjaden/status/329768040235413504?lang=en https://twitter.com/officialjaden/status/329768040235413504?...
        Piskvorrr 10y ago
        "If real is what you can feel, smell, taste and see, then 'real' is simply electrical signals interpreted by your brain." -Morpheus, The Matrix (finally, finally there's a use for that quote!)
stouset 10y ago
Because then you have the web of trust model, which absolutely sucks in practice for people to actually use. So yes, you could do this. But outside of a few hundred people, nobody wants to actually undergo the constant effort this would actually require.
jldugger 10y ago
> I've often wondered: why is trust in CAs an all-or-nothing proposition (aside from EV certs), and why should my particular browser vendor have all the authority over who I should trust? It doesn't. You can adjust your root certs in Firefox by going to about:preferences#advanced and clicking on certificates. But what does partial trust look like? Showing half of the HTML? An eyebrow raised emoji instead of a lock?
- unethical_ban 10y ago
  I wish CA management was easier to bulk-edit. Show me a table of root CAs with their data, their country of origin, etc., and allow me to filter and enable/disable all based on filters. Full disable would shut down trust entirely, and get the warnings similar to a self-issued cert. Reduced trust would have a "not Secure" label or something, like a plain http connection.
  - syncsynchalt 10y ago
    Many CAs are cross-signed, what should the software do in that case?
  - tialaramex 10y ago
    "Country of origin" is a really interesting one for precisely the Symantec scenario. Symantec is a US company right? But the main _problem_ happened at a company called CrossCert, full name Korea Electronic Certification Authority. They're Korean. So if you decided you don't trust Koreans, Symantec's root looks fine, nothing Korean about that. Except, somewhere Symantec signed a contract with CrossCert saying "OK, we'll issue any certificate you want, so long as you pay us and promise to do all these things". Oh, and then they didn't actually check CrossCert did any of the other things (I think we can assume they checked they got paid...). You don't get to see that contract. It wasn't even prohibited by the rules Symantec had agreed to. If Symantec hadn't been caught issuing bogus certificates as a result you wouldn't even be reading about it.
- tlrobinson 10y ago
  For example: Full trust: green lock icon Medium trust: yellow lock icon with list of reasons when clicked Low trust: prompt when attempting to load No trust: completely blocked, or more difficult to override (like Chrome does now)
greenhouse_gas 10y ago
You can always disable everything except for LE. It's not WoT because WoT is supposed to help you know of unknown people are secure (say LE and FSF trusts ABC, it probably means that ABC is reliable), which doesn't work at all

andrewfong 10y ago

> Or I could subscribe to feeds from other entities I trust, like the EFF. How would you validate that the EFF's feed is actually from the EFF? Assuming we're using existing SSL infrastructure, the browser would first need to trust the CA used by the EFF, which means we need an initial set of trusted CAs.

jf 10y ago
> which means we need an initial set of trusted CAs. How would you validate that the initial set of trusted CA roots is actually from those CAs?
- inglor 10y ago
  It ships with your operating system, which you physically obtain from another computer (with hardware like a USB drive or via internal network).
  - tscs37 10y ago
    But how to trust that this other computer has a good set of CAs?
    - shawnz 10y ago
      How can you know your signing software is not backdoored? How can you know you're not living in a computer simulation?
      - tscs37 10y ago
        Well, I'm certain my eyes are real so I am certainly not living in a computer simulation.
        iamatworknow 10y ago
        How Can Our CA Roots Be Real If Our Eyes Aren't Real https://twitter.com/officialjaden/status/329768040235413504?lang=en https://twitter.com/officialjaden/status/329768040235413504?...
        Piskvorrr 10y ago
        "If real is what you can feel, smell, taste and see, then 'real' is simply electrical signals interpreted by your brain." -Morpheus, The Matrix (finally, finally there's a use for that quote!)

stouset 10y ago

Because then you have the web of trust model, which absolutely sucks in practice for people to actually use. So yes, you could do this. But outside of a few hundred people, nobody wants to actually undergo the constant effort this would actually require.

jldugger 10y ago

> I've often wondered: why is trust in CAs an all-or-nothing proposition (aside from EV certs), and why should my particular browser vendor have all the authority over who I should trust? It doesn't. You can adjust your root certs in Firefox by going to about:preferences#advanced and clicking on certificates. But what does partial trust look like? Showing half of the HTML? An eyebrow raised emoji instead of a lock?

unethical_ban 10y ago
I wish CA management was easier to bulk-edit. Show me a table of root CAs with their data, their country of origin, etc., and allow me to filter and enable/disable all based on filters. Full disable would shut down trust entirely, and get the warnings similar to a self-issued cert. Reduced trust would have a "not Secure" label or something, like a plain http connection.
- syncsynchalt 10y ago
  Many CAs are cross-signed, what should the software do in that case?
- tialaramex 10y ago
  "Country of origin" is a really interesting one for precisely the Symantec scenario. Symantec is a US company right? But the main _problem_ happened at a company called CrossCert, full name Korea Electronic Certification Authority. They're Korean. So if you decided you don't trust Koreans, Symantec's root looks fine, nothing Korean about that. Except, somewhere Symantec signed a contract with CrossCert saying "OK, we'll issue any certificate you want, so long as you pay us and promise to do all these things". Oh, and then they didn't actually check CrossCert did any of the other things (I think we can assume they checked they got paid...). You don't get to see that contract. It wasn't even prohibited by the rules Symantec had agreed to. If Symantec hadn't been caught issuing bogus certificates as a result you wouldn't even be reading about it.
tlrobinson 10y ago
For example: Full trust: green lock icon Medium trust: yellow lock icon with list of reasons when clicked Low trust: prompt when attempting to load No trust: completely blocked, or more difficult to override (like Chrome does now)

greenhouse_gas 10y ago

You can always disable everything except for LE. It's not WoT because WoT is supposed to help you know of unknown people are secure (say LE and FSF trusts ABC, it probably means that ABC is reliable), which doesn't work at all