5 ms·

Is there a list somewhere of trustworthy CAs? Something akin to lists of recommended TLS versions and cipher suites? [1][2] [1]: https://wiki.mozilla.org/Secu

Is there a list somewhere of trustworthy CAs? Something akin to lists of recommended TLS versions and cipher suites? [1][2] [1]: https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS [2]: https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Sheet https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Shee...

CaliforniaKarl 9y ago
Aha! I think's one of the major issues here! You mentioned TLS versions and cipher suites. TLS is documented in a set of RFCs, so if you want to answer the question "Does software X implement TLS version 1.2?", then you can answer that question by checking its behavior against RFC 5246. As far as I'm aware, there is no RFC which quantifies trust.
Aissen 9y ago
Yes, there are a few lists. According to Microsoft, it's the one they embed in Windows, Edge, etc. According to the Chrome team, it's the one in their store. According to Debian, it's the one in Mozilla's CA bundle, etc.
- Dylan16807 9y ago
  That's true for a relatively low bar, not really equivalent to a list of "recommended" ciphers. The equivalent is probably the 15 CAs with >0.1% marketshare plus a few more particularly well-run ones.
- chaz6 9y ago
  The irony is, these companies that operate trust lists accept zero responsibility in the case you are defrauded using a certificate issued by a CA they deem trustworthy.
  - psergeant 9y ago
    Why is that ironic? How much do you pay for access to Mozilla’s trust store?
  - dtech 9y ago
    You are of course free to maintain your own list and not use the lists they provide for free if this is your concern.
  - lfam 9y ago
    I don't think that fraudulent behavior by site operators is relevant to the X.509 certificate system. All that the certificates do is make it possible to ensure you are talking to the server at the address you intend to communicate with. TLS has nothing to do with the morality, ethics or legality of the site operator. It's too bad that the English word "trust" has so many meanings that people get confused about what it means in this context.
tialaramex 9y ago
You can and should operate your own root trust programme, or club together with other people who have the same idea of what constitutes trustworthy. If, like most of us, you prefer to delegate this problem to your OS vendor then you get to keep both halves when it breaks. The main trust stores today are operated by Microsoft (for Windows), Apple (for Mac OS and iOS), Mozilla (Firefox and all the Free Unix systems), Google (Android), and Oracle (Java). Smaller or less frequently updated stores are operated by a large number of organisations, including Sony, Nintendo, Avaya, IBM and so on. All the big stores either explicitly publish a list of what's trusted or provide an obvious way to work it out and some third party aggregates the results. Most of the trust programmes are completely opaque and proprietary. Mozilla's is open to the public as you'd expect, Google openly relies on Mozilla's process although it takes its own final decisions. Microsoft uses the shared CCADB with Mozilla but doesn't publicly talk about its trust processes. https://ccadb-public.secure.force.com/mozilla/CACertificatesInFirefoxReport https://ccadb-public.secure.force.com/mozilla/CACertificates...

CaliforniaKarl 9y ago

Aha! I think's one of the major issues here! You mentioned TLS versions and cipher suites. TLS is documented in a set of RFCs, so if you want to answer the question "Does software X implement TLS version 1.2?", then you can answer that question by checking its behavior against RFC 5246. As far as I'm aware, there is no RFC which quantifies trust.

Aissen 9y ago

Yes, there are a few lists. According to Microsoft, it's the one they embed in Windows, Edge, etc. According to the Chrome team, it's the one in their store. According to Debian, it's the one in Mozilla's CA bundle, etc.

Dylan16807 9y ago
That's true for a relatively low bar, not really equivalent to a list of "recommended" ciphers. The equivalent is probably the 15 CAs with >0.1% marketshare plus a few more particularly well-run ones.
chaz6 9y ago
The irony is, these companies that operate trust lists accept zero responsibility in the case you are defrauded using a certificate issued by a CA they deem trustworthy.
- psergeant 9y ago
  Why is that ironic? How much do you pay for access to Mozilla’s trust store?
- dtech 9y ago
  You are of course free to maintain your own list and not use the lists they provide for free if this is your concern.
- lfam 9y ago
  I don't think that fraudulent behavior by site operators is relevant to the X.509 certificate system. All that the certificates do is make it possible to ensure you are talking to the server at the address you intend to communicate with. TLS has nothing to do with the morality, ethics or legality of the site operator. It's too bad that the English word "trust" has so many meanings that people get confused about what it means in this context.

tialaramex 9y ago

You can and should operate your own root trust programme, or club together with other people who have the same idea of what constitutes trustworthy. If, like most of us, you prefer to delegate this problem to your OS vendor then you get to keep both halves when it breaks. The main trust stores today are operated by Microsoft (for Windows), Apple (for Mac OS and iOS), Mozilla (Firefox and all the Free Unix systems), Google (Android), and Oracle (Java). Smaller or less frequently updated stores are operated by a large number of organisations, including Sony, Nintendo, Avaya, IBM and so on. All the big stores either explicitly publish a list of what's trusted or provide an obvious way to work it out and some third party aggregates the results. Most of the trust programmes are completely opaque and proprietary. Mozilla's is open to the public as you'd expect, Google openly relies on Mozilla's process although it takes its own final decisions. Microsoft uses the shared CCADB with Mozilla but doesn't publicly talk about its trust processes. https://ccadb-public.secure.force.com/mozilla/CACertificatesInFirefoxReport https://ccadb-public.secure.force.com/mozilla/CACertificates...