4 ms·

> These are some of the most important organizations in the world and you'll cause worldwide chaos Thanks for that -- reading this comment connected a few thou

by mdip 10y ago

> These are some of the most important organizations in the world and you'll cause worldwide chaos Thanks for that -- reading this comment connected a few thoughts I was struggling with. Their response felt like "if you don't follow through with your plan to punish us we'll do all of these nice things for you." It reminds me of when my kids get caught doing something wrong and I get "but I'll do all of my chores and treat my siblings nice" along with a handful of other promises of future deeds which I know will be partially or completely not-done. How different the result would have been if they came to me with the chores done and some/all of the promises fulfilled already. It would have been much better for Symantec to have responded with these items in the "completed" category with a smaller number of "we will's". But to the quote I highlighted: the issue at hand is the past failures indicate that "some of the most important organizations in the world" need to not be trusting Symantec in the first place. They've had a big enough history of failures as a CA to get the attention of Google, who I'm sure isn't terribly interested in degrading the browsing experience of their customers. The choice becomes: (1) Banhammer Symantec, take the resulting pain all at once, visibly and obviously, and get the problem fixed painfully (but it's fixed) or (2) Trust that things will be different this time and if they're not, have another security failure of some kind that results in these critically important company's customers' data being exposed, which is a circumstance that will almost certainly go unnoticed for a period of time, will be covered up if the exposure is minimal and covering up the exposure is possible or may not be discovered at all. The CA system is centered around trusting a handful of rather powerful bodies with an enormous responsibility around the overall security of the Internet. It's not a great model to begin with, but it's what we have and I haven't read about any alternatives that are viable. The only way to keep a model like this secure is to ensure that the CAs themselves are actually trustworthy and one of the more likely ways that will happen is to enforce violations of that trust in the manner Google is suggesting.

geofft 10y ago
Yup. It's very interesting that the argument from Symantec is that their customers have to buy Symantec certs indefinitely - not that they can't replace existing certs in servers, but they've hardcoded the Symantec root in enough clients, such that buying certs from a Symantec competitor will break their clients. Among other things, if what Symantec is saying is true, this means there is zero financial incentive for Symantec to behave. The largest certificate customers in the world have all voluntarily made it infeasible to choose a Symantec competitor, so as long as Symantec has any product at all of any quality, the market will keep buying Symantec. If what Symantec is saying is true, the mere fact that they went to their largest customers and said "Suppose you had to buy certs from one of our competitors, what would you do" and they replied "We've never thought about that before" is itself a major victory.
- mdip 10y ago
  I hadn't read it that way and that's a really good point. If you have too many trusted-third parties in a trust model like this, you run into difficulties with enforcement due to scaling problems, but what we're seeing is the converse of that. Symantec went out and bought up other CAs (Verisign is the only one I can remember for some reason) and they've become so large that them losing CA status would be prohibitively damaging to the internet-at-large. This affects not only enforcement (we don't want to move on a bad actor because the consequences of enforcement would be more severe than the consequences of a rule violation), it also negatively affects the trust model -- now if I'm a bad actor, Symantec is my only target -- even though I could attack the others and yield some of the same benefits of attacking Symantec, if I breach Symantec, the rewards are larger by several orders of magnitude depending on what they store and how they store it. To digress a little ... today ... I'm not all that surprised that Symantec has reached sort-of monopoly status in this area. Not because Symantec is a well managed company (I'm making no statement for or against that despite my personal opinions), but just because so much of The Internet has turned out this way. If you would have told me in 1998 that for the very vast majority of US Internet users, there'd be one search engine, one e-commerce company, one (expensive) ISP, one e-mail provider, all of it would be secured by services provided by one company's CA and all of that wouldn't matter much because the typical Internet experience would basically be a web-enabled, bluer version of AOL[0], I'd have called you some unfriendly things, but that's where we are. It's a centralized system operating on decentralized technology. [0] Oh, and that the "one e-commerce company" was that bookstore web-site and would be responsible for hosting such a large part of the rest of the Internet that when they had a major failure and people had that handful of rare clicks off of FAOLBook, they'd have about a 50% chance that whatever their target was wouldn't load.

by mdip 10y ago

geofft 10y ago

Yup. It's very interesting that the argument from Symantec is that their customers have to buy Symantec certs indefinitely - not that they can't replace existing certs in servers, but they've hardcoded the Symantec root in enough clients, such that buying certs from a Symantec competitor will break their clients. Among other things, if what Symantec is saying is true, this means there is zero financial incentive for Symantec to behave. The largest certificate customers in the world have all voluntarily made it infeasible to choose a Symantec competitor, so as long as Symantec has any product at all of any quality, the market will keep buying Symantec. If what Symantec is saying is true, the mere fact that they went to their largest customers and said "Suppose you had to buy certs from one of our competitors, what would you do" and they replied "We've never thought about that before" is itself a major victory.

mdip 10y ago
I hadn't read it that way and that's a really good point. If you have too many trusted-third parties in a trust model like this, you run into difficulties with enforcement due to scaling problems, but what we're seeing is the converse of that. Symantec went out and bought up other CAs (Verisign is the only one I can remember for some reason) and they've become so large that them losing CA status would be prohibitively damaging to the internet-at-large. This affects not only enforcement (we don't want to move on a bad actor because the consequences of enforcement would be more severe than the consequences of a rule violation), it also negatively affects the trust model -- now if I'm a bad actor, Symantec is my only target -- even though I could attack the others and yield some of the same benefits of attacking Symantec, if I breach Symantec, the rewards are larger by several orders of magnitude depending on what they store and how they store it. To digress a little ... today ... I'm not all that surprised that Symantec has reached sort-of monopoly status in this area. Not because Symantec is a well managed company (I'm making no statement for or against that despite my personal opinions), but just because so much of The Internet has turned out this way. If you would have told me in 1998 that for the very vast majority of US Internet users, there'd be one search engine, one e-commerce company, one (expensive) ISP, one e-mail provider, all of it would be secured by services provided by one company's CA and all of that wouldn't matter much because the typical Internet experience would basically be a web-enabled, bluer version of AOL[0], I'd have called you some unfriendly things, but that's where we are. It's a centralized system operating on decentralized technology. [0] Oh, and that the "one e-commerce company" was that bookstore web-site and would be responsible for hosting such a large part of the rest of the Internet that when they had a major failure and people had that handful of rare clicks off of FAOLBook, they'd have about a 50% chance that whatever their target was wouldn't load.