4 ms·

> Browsers need to remove all CAs except Let's Encrypt. No. I love Let's Encrypt, but we can't put all our eggs in a single basket like that. Now, if we could

> Browsers need to remove all CAs except Let's Encrypt. No. I love Let's Encrypt, but we can't put all our eggs in a single basket like that. Now, if we could somehow foster multiple non-profit organizations like Let's Encrypt, but run under the aegis of different boards and sponsors, I'd be 100% for this idea. It's very odd that companies for whom CAs business is quite literally a money printing operation can't be bothered to do the relatively minimal maintenance and care required for a trustworthy CA. A bizarre and unexpected failure of the market.

jakewins 9y ago
> A bizarre and unexpected failure of the market. The consumers are, partially, buying a product they can't see: The security operations of the vendor. Given the consumer has imperfect information, it is exceptionally profitable for a supplier to just not invest in security. The downside being the risk of compromise. A market set up this way entirely predicts low-cost suppliers. With no way for consumers to introspect security routines, two vendors will appear to simply differ in price. The outcome is rather obvious.
azernik 9y ago
This market failure is neither bizarre nor unexpected. The CAs are like ratings agencies in the financial crisis: they are in the business of selling to one party (the website) a credential that they offer to a third party (the browser). Their incentives are aligned to make them sell certificates as cheaply as possible, and they are of course willing to trade off as much security as possible for convenience/cost, as long as they don't go over the lines defined by internet governing bodies and browser vendors. And when they're pushing those boundaries, every once in a while they're going to make a mistake.
devit 9y ago
Security requires that ALL CAs be secure, since any compromised CA can compromise all websites (barring fragile schemes like pinning or certificate transparency checks), so the less CAs there are, the more secure the system is. It's like a building that needs secure doors: it's better to invest in a single, massive, bulletproof, guarded door rather than inviting anyone who meets some standards to add a door to the building, since what matters is the weakest door.
- manigandham 9y ago
  The proper solution is to actually make sure the CAs are secure, it doesn't matter if there are 1 or many. Also more CAs mean that any problems are only localized to their certificates instead of the entire internet.
- jopsen 9y ago
  Certificate transparency seems like it'll make a compromised CA much less of an issue. If it can be reliably proven that a CA is compromised, then it can be fixed.

jakewins 9y ago

> A bizarre and unexpected failure of the market. The consumers are, partially, buying a product they can't see: The security operations of the vendor. Given the consumer has imperfect information, it is exceptionally profitable for a supplier to just not invest in security. The downside being the risk of compromise. A market set up this way entirely predicts low-cost suppliers. With no way for consumers to introspect security routines, two vendors will appear to simply differ in price. The outcome is rather obvious.

azernik 9y ago

This market failure is neither bizarre nor unexpected. The CAs are like ratings agencies in the financial crisis: they are in the business of selling to one party (the website) a credential that they offer to a third party (the browser). Their incentives are aligned to make them sell certificates as cheaply as possible, and they are of course willing to trade off as much security as possible for convenience/cost, as long as they don't go over the lines defined by internet governing bodies and browser vendors. And when they're pushing those boundaries, every once in a while they're going to make a mistake.

devit 9y ago

Security requires that ALL CAs be secure, since any compromised CA can compromise all websites (barring fragile schemes like pinning or certificate transparency checks), so the less CAs there are, the more secure the system is. It's like a building that needs secure doors: it's better to invest in a single, massive, bulletproof, guarded door rather than inviting anyone who meets some standards to add a door to the building, since what matters is the weakest door.

manigandham 9y ago
The proper solution is to actually make sure the CAs are secure, it doesn't matter if there are 1 or many. Also more CAs mean that any problems are only localized to their certificates instead of the entire internet.
jopsen 9y ago
Certificate transparency seems like it'll make a compromised CA much less of an issue. If it can be reliably proven that a CA is compromised, then it can be fixed.