11 ms·

> We’ve seen programs such as Let’s Encrypt that bring the price of domain name public key certificates down to a base of free. And, interestingly enough, turn

> We’ve seen programs such as Let’s Encrypt that bring the price of domain name public key certificates down to a base of free. And, interestingly enough, turn the implicit assumptions behind the whole XPKI infrastructure on their head. CAs built their business on the idea that we needed to know that sears.com is Sears, Roebuck & Co., while sears.net is a family website. But it turns out that we don't really care: we care that google.com is google.com, and that's it. What we really want is to know that the IP address we're talking to is the IP address we think we're talking to, and that the IP address we're talking to is the one we looked up for a particular DNS name. What we really want is not an identity-authentication certificate, but rather authorisation certificates. Over twenty years ago, RFCs 2692 & 2693 (and follow-up draft work) identified the issue, and offered a solution — but the industry stuck with identity-authentication certificates. This is kinda crazy when you think of it: knowing who someone is doesn't guarantee that I want to do business with him.

pbhjpbhj 9y ago
>"CAs built their business on the idea that we needed to know that sears.com is Sears, Roebuck & Co., while sears.net is a family website. But it turns out that we don't really care: " // Don't we? I think people in general do care, but having a cert doesn't show it to be true unless you trust all CAs?
- michaelcampbell 9y ago
  I think in general, no, we don't. I know this crowd thrives on the non-general, pedantic edge cases, however, so it depends on which "we" we are talking about.
ballenf 9y ago
> But it turns out that we don't really care: we care that google.com is google.com, and that's it. It's worse than that. 9/10 users I observe 'google'* google in order to run a google search. Every single time they go to a website that isn't saved as a bookmark, they search for it instead of typing an address into the address bar. I used to be surprised seeing people google 'gmail' and then click the top ad every morning... But I don't blame the users as much anymore. The companies that makes the browsers and web search know all this too and the UI has actually evolved to further muddy the difference between search and address. (Increasingly they bing it due to MS defaults in Win 10.) But your overall point is well taken and very true: having the sears.com domain name might not be as important as having the top google hit for 'sears'.
- Jtsummers 9y ago
  I used to be like that with real world directions. Constantly referencing maps, people, or (later) smart phone maps. Then I started forcing myself to develop an internal model of the regions I was traveling in, now I only use the smart phone map for ETA and traffic information. I think most people never really develop that mental model of how the internet is laid out. I would get lost going from A->C or C->A. But I could go A->Town Center->C no problem (and the reverse) but it took twice as long because I was taking a suboptimal route. Everyone knows where Google is, it's the town center of the internet (for them), like the portal sites that MSN, Yahoo!, and others provide. So they go there and use it to make their way to their desired destination.
  - hobs 9y ago
    This is really apt, people who are not adepts choose reliable routes to success over potentially faster ones, and often reject your "better way" because it requires some subtlety in their mental model or an exception to a rule that didn't already exist.
  - Jach 9y ago
    I turned into the opposite for real world directions. I let google tell me where to go, only rarely deciding a different route on my own. And sometimes that's not exactly a fully formed different route but I want to go via a certain way (e.g. non-freeway) and hope google updates the rest of its directions to accord to that wish. It's taken me on some weird paths but whatever. My excuse is that I grew up in Utah, which has a fairly consistent and ordered grid system with addresses almost always mapping to grid coordinates, so given an address you don't need any special directions. You might still go to a main road because it's faster, but you could instead optimize the Manhattan distance without effort. Traveling elsewhere with places so fond of nonsensical street names and non-grids, I gave up actively building a mental model (I have an ok spatial model of my surrounding area in Bellevue/Redmond but I've been here almost a decade...I have no idea where most of the street names in Seattle proper fall and haven't bothered to learn any of the mnemonics people have suggested) and let the machine tell me what to do.
ryanlol 9y ago
>CAs built their business on the idea that we needed to know that sears.com is Sears, Roebuck & Co., while sears.net is a family website What do you mean? This is only true for EV certs.
- tialaramex 9y ago
  To be fair, CAs are somewhat _older_ than the Web PKI and even the Web PKI starts out with what you'd now think of as the EV model. In the early 1990s Tim's ludicrous toy hypertext system is suddenly the New Hotness and people who had barely grasped by Email was a good idea are starting to realise that maybe this whole Internet thing might not be a temporary phase before we all settle down to using AOL (yes, AOL used to be its own thing not just an obscure corner of the Internet) A graphical web browser called Mosaic has been invented by (of all things) the National Centre for Supercomputing to make Tim's crazy toy a riot of pictures as well as text, linked together over the Internet, and some of the people who worked on that, plus a whole lot of other good software engineers hired from other work are now at this startup which is initially also named "Mosaic" but eventually becomes famous to us as "Netscape" before the Microsoft corporation drives it out of business. Anyway, at Netscape they're more focused on commercially friendly applications of this technology than the academics who've worked on it before, and one thing they realise is that Tim (being a physicist not really a software engineer or computer scientist) hasn't built any workable security into this thing. So they invent a Secure Socket Layer, the idea is to use all the same stuff as the Web except with Cryptography to protect it. Nobody working on this stuff is a serious cryptographer, but they do eventually cobble together something that isn't laughable, on their second attempt, SSLv2. One of the fixes they realise they need is that encrypting data to just some random yahoo on the Internet is pointless - bad guys can just arrange to be Man-in-the-middle and you've got to stop that. So somebody needs to take responsibility for figuring out who is who. If Netscape insists this is them, that's clearly a huge landgrab, nobody will buy it and SSL will be dead. But what if they out-source it to these companies called Certificate Authorities, that do the same sort of thing already for products in the banking and legal industries? So initially, a CA is a big company like Verisign that already has a business checking people's identities, and this is a new side to it, they don't spin up all new infrastructure, they just make a web page on this new-fangled World Wide Web saying they can offer "SSL certificates". They are verifying real world identities because an "Internet identity" is still a pretty new idea for them. Now, these certs were expensive, and there was of course a pressure to find a way to make a product that was cheaper - not for customers, who cares what it costs customers? No, cheaper to make, so you could keep more profit. And the solution was "Domain validated" certificates. Gradually CAs began writing "Domain validated" in the slots where it should say e.g. the Organization name of the subject, and just sending an email out to "validate" that they really controlled a domain. EV as you know it today comes into being much later, only about a decade ago, as the Browser Vendors (by now including Mozilla, the successor to Netscape that was now a not-for-profit and a pretty angry pro-user one) realised that a Wild West of certificates issued by CAs wasn't in their interests.
kerkeslager 9y ago
> CAs built their business on the idea that we needed to know that sears.com is Sears, Roebuck & Co., while sears.net is a family website. But it turns out that we don't really care: we care that google.com is google.com, and that's it. Perhaps more critically, we've proven that even if we wanted to know that sears.com is Sears, Roebuck & Co., CAs can't be trusted to tell us that reliably.
ta76567656 9y ago
But it turns out that we don't really care I care - it's annoying to have to check whether there's a typo in te URL every time I want to trust a website using SSL.

pbhjpbhj 9y ago

>"CAs built their business on the idea that we needed to know that sears.com is Sears, Roebuck & Co., while sears.net is a family website. But it turns out that we don't really care: " // Don't we? I think people in general do care, but having a cert doesn't show it to be true unless you trust all CAs?

michaelcampbell 9y ago
I think in general, no, we don't. I know this crowd thrives on the non-general, pedantic edge cases, however, so it depends on which "we" we are talking about.

ballenf 9y ago

> But it turns out that we don't really care: we care that google.com is google.com, and that's it. It's worse than that. 9/10 users I observe 'google'* google in order to run a google search. Every single time they go to a website that isn't saved as a bookmark, they search for it instead of typing an address into the address bar. I used to be surprised seeing people google 'gmail' and then click the top ad every morning... But I don't blame the users as much anymore. The companies that makes the browsers and web search know all this too and the UI has actually evolved to further muddy the difference between search and address. (Increasingly they bing it due to MS defaults in Win 10.) But your overall point is well taken and very true: having the sears.com domain name might not be as important as having the top google hit for 'sears'.

Jtsummers 9y ago
I used to be like that with real world directions. Constantly referencing maps, people, or (later) smart phone maps. Then I started forcing myself to develop an internal model of the regions I was traveling in, now I only use the smart phone map for ETA and traffic information. I think most people never really develop that mental model of how the internet is laid out. I would get lost going from A->C or C->A. But I could go A->Town Center->C no problem (and the reverse) but it took twice as long because I was taking a suboptimal route. Everyone knows where Google is, it's the town center of the internet (for them), like the portal sites that MSN, Yahoo!, and others provide. So they go there and use it to make their way to their desired destination.
- hobs 9y ago
  This is really apt, people who are not adepts choose reliable routes to success over potentially faster ones, and often reject your "better way" because it requires some subtlety in their mental model or an exception to a rule that didn't already exist.
- Jach 9y ago
  I turned into the opposite for real world directions. I let google tell me where to go, only rarely deciding a different route on my own. And sometimes that's not exactly a fully formed different route but I want to go via a certain way (e.g. non-freeway) and hope google updates the rest of its directions to accord to that wish. It's taken me on some weird paths but whatever. My excuse is that I grew up in Utah, which has a fairly consistent and ordered grid system with addresses almost always mapping to grid coordinates, so given an address you don't need any special directions. You might still go to a main road because it's faster, but you could instead optimize the Manhattan distance without effort. Traveling elsewhere with places so fond of nonsensical street names and non-grids, I gave up actively building a mental model (I have an ok spatial model of my surrounding area in Bellevue/Redmond but I've been here almost a decade...I have no idea where most of the street names in Seattle proper fall and haven't bothered to learn any of the mnemonics people have suggested) and let the machine tell me what to do.

ryanlol 9y ago

>CAs built their business on the idea that we needed to know that sears.com is Sears, Roebuck & Co., while sears.net is a family website What do you mean? This is only true for EV certs.

tialaramex 9y ago
To be fair, CAs are somewhat _older_ than the Web PKI and even the Web PKI starts out with what you'd now think of as the EV model. In the early 1990s Tim's ludicrous toy hypertext system is suddenly the New Hotness and people who had barely grasped by Email was a good idea are starting to realise that maybe this whole Internet thing might not be a temporary phase before we all settle down to using AOL (yes, AOL used to be its own thing not just an obscure corner of the Internet) A graphical web browser called Mosaic has been invented by (of all things) the National Centre for Supercomputing to make Tim's crazy toy a riot of pictures as well as text, linked together over the Internet, and some of the people who worked on that, plus a whole lot of other good software engineers hired from other work are now at this startup which is initially also named "Mosaic" but eventually becomes famous to us as "Netscape" before the Microsoft corporation drives it out of business. Anyway, at Netscape they're more focused on commercially friendly applications of this technology than the academics who've worked on it before, and one thing they realise is that Tim (being a physicist not really a software engineer or computer scientist) hasn't built any workable security into this thing. So they invent a Secure Socket Layer, the idea is to use all the same stuff as the Web except with Cryptography to protect it. Nobody working on this stuff is a serious cryptographer, but they do eventually cobble together something that isn't laughable, on their second attempt, SSLv2. One of the fixes they realise they need is that encrypting data to just some random yahoo on the Internet is pointless - bad guys can just arrange to be Man-in-the-middle and you've got to stop that. So somebody needs to take responsibility for figuring out who is who. If Netscape insists this is them, that's clearly a huge landgrab, nobody will buy it and SSL will be dead. But what if they out-source it to these companies called Certificate Authorities, that do the same sort of thing already for products in the banking and legal industries? So initially, a CA is a big company like Verisign that already has a business checking people's identities, and this is a new side to it, they don't spin up all new infrastructure, they just make a web page on this new-fangled World Wide Web saying they can offer "SSL certificates". They are verifying real world identities because an "Internet identity" is still a pretty new idea for them. Now, these certs were expensive, and there was of course a pressure to find a way to make a product that was cheaper - not for customers, who cares what it costs customers? No, cheaper to make, so you could keep more profit. And the solution was "Domain validated" certificates. Gradually CAs began writing "Domain validated" in the slots where it should say e.g. the Organization name of the subject, and just sending an email out to "validate" that they really controlled a domain. EV as you know it today comes into being much later, only about a decade ago, as the Browser Vendors (by now including Mozilla, the successor to Netscape that was now a not-for-profit and a pretty angry pro-user one) realised that a Wild West of certificates issued by CAs wasn't in their interests.

kerkeslager 9y ago

> CAs built their business on the idea that we needed to know that sears.com is Sears, Roebuck & Co., while sears.net is a family website. But it turns out that we don't really care: we care that google.com is google.com, and that's it. Perhaps more critically, we've proven that even if we wanted to know that sears.com is Sears, Roebuck & Co., CAs can't be trusted to tell us that reliably.

ta76567656 9y ago

But it turns out that we don't really care I care - it's annoying to have to check whether there's a typo in te URL every time I want to trust a website using SSL.