4 ms·

Yeah, but I feel there's at least like a 30%+ chance that their attempt to make this mandatory will stop in its tracks. I just don't see corporations being okay

Yeah, but I feel there's at least like a 30%+ chance that their attempt to make this mandatory will stop in its tracks. I just don't see corporations being okay with it.

jlgaddis 9y ago
There's some work (in the CA/B?) to allow "redacting" certain information from CT logs. I don't recall all the details but I do remember reading an e-mail thread (maybe linked from HN?) about it in just the last week or so.
tialaramex 9y ago
Mandatory logging is a necessary element of the CT design. What we have today is basically like the trial demo of the game. Full CT requires the completion of "gossip protocols", log auditor third parties which detect inconsistencies and a bunch of other stuff that exists today only in the laboratory, you haven't seen the half of it. The option left open by the Chrome team was what's called redaction. The logged document would be partly redacted by for example removing host names. It's not impossible that redaction will happen and end up being accepted, but its biggest proponent was Symantec, who are exiting the business after destroying trust by not exercising proper oversight on their relationship with Korea's CrossCert. And frankly the redaction proposed was getting ludicrous anyway. The trouble is that people who most want this, as with Brass Plate companies, aren't just looking to avoid excess publicity. What they want is to act entirely with impunity. And that's exactly what CT is there to prevent.
gsich 9y ago
Why? If you are in a corporation and don't want to show your hosts in the CT logs, don't use CAs then. In a company I don't see a problem with rolling out certificates with an own CA.
- throwaway613834 9y ago
  Because you want your employees to be able to easily access a domain externally without unnecessarily advertising its existence to the entire planet?
  - gsich 9y ago
    Oh I forgot "internal hosts" in the comment. If you want external access you can still use your own CA. I think one can assume that an employee (with an employee device) has the CA installed. If this is a public host or you can't control the employee devices, then use a public cert, or live with the error message. This is not an unsolvable problem.
    - throwaway613834 9y ago
      > If this is a public host or you can't control the employee devices, then use a public cert, or live with the error message. > This is not an unsolvable problem. You literally just did not solve it.
      - gsich 9y ago
        Why not? If it's a public host, use a public CA. No need to hide it there. If it's an internal host, use your own CA. What is the problem?

Yeah, but I feel there's at least like a 30%+ chance that their attempt to make this mandatory will stop in its tracks. I just don't see corporations being okay with it.

jlgaddis 9y ago

There's some work (in the CA/B?) to allow "redacting" certain information from CT logs. I don't recall all the details but I do remember reading an e-mail thread (maybe linked from HN?) about it in just the last week or so.

tialaramex 9y ago

Mandatory logging is a necessary element of the CT design. What we have today is basically like the trial demo of the game. Full CT requires the completion of "gossip protocols", log auditor third parties which detect inconsistencies and a bunch of other stuff that exists today only in the laboratory, you haven't seen the half of it. The option left open by the Chrome team was what's called redaction. The logged document would be partly redacted by for example removing host names. It's not impossible that redaction will happen and end up being accepted, but its biggest proponent was Symantec, who are exiting the business after destroying trust by not exercising proper oversight on their relationship with Korea's CrossCert. And frankly the redaction proposed was getting ludicrous anyway. The trouble is that people who most want this, as with Brass Plate companies, aren't just looking to avoid excess publicity. What they want is to act entirely with impunity. And that's exactly what CT is there to prevent.

gsich 9y ago

Why? If you are in a corporation and don't want to show your hosts in the CT logs, don't use CAs then. In a company I don't see a problem with rolling out certificates with an own CA.

throwaway613834 9y ago
Because you want your employees to be able to easily access a domain externally without unnecessarily advertising its existence to the entire planet?
- gsich 9y ago
  Oh I forgot "internal hosts" in the comment. If you want external access you can still use your own CA. I think one can assume that an employee (with an employee device) has the CA installed. If this is a public host or you can't control the employee devices, then use a public cert, or live with the error message. This is not an unsolvable problem.
  - throwaway613834 9y ago
    > If this is a public host or you can't control the employee devices, then use a public cert, or live with the error message. > This is not an unsolvable problem. You literally just did not solve it.
    - gsich 9y ago
      Why not? If it's a public host, use a public CA. No need to hide it there. If it's an internal host, use your own CA. What is the problem?