3 ms·

>CAs built their business on the idea that we needed to know that sears.com is Sears, Roebuck & Co., while sears.net is a family website What do you mean? This

>CAs built their business on the idea that we needed to know that sears.com is Sears, Roebuck & Co., while sears.net is a family website What do you mean? This is only true for EV certs.

tialaramex 9y ago
To be fair, CAs are somewhat _older_ than the Web PKI and even the Web PKI starts out with what you'd now think of as the EV model. In the early 1990s Tim's ludicrous toy hypertext system is suddenly the New Hotness and people who had barely grasped by Email was a good idea are starting to realise that maybe this whole Internet thing might not be a temporary phase before we all settle down to using AOL (yes, AOL used to be its own thing not just an obscure corner of the Internet) A graphical web browser called Mosaic has been invented by (of all things) the National Centre for Supercomputing to make Tim's crazy toy a riot of pictures as well as text, linked together over the Internet, and some of the people who worked on that, plus a whole lot of other good software engineers hired from other work are now at this startup which is initially also named "Mosaic" but eventually becomes famous to us as "Netscape" before the Microsoft corporation drives it out of business. Anyway, at Netscape they're more focused on commercially friendly applications of this technology than the academics who've worked on it before, and one thing they realise is that Tim (being a physicist not really a software engineer or computer scientist) hasn't built any workable security into this thing. So they invent a Secure Socket Layer, the idea is to use all the same stuff as the Web except with Cryptography to protect it. Nobody working on this stuff is a serious cryptographer, but they do eventually cobble together something that isn't laughable, on their second attempt, SSLv2. One of the fixes they realise they need is that encrypting data to just some random yahoo on the Internet is pointless - bad guys can just arrange to be Man-in-the-middle and you've got to stop that. So somebody needs to take responsibility for figuring out who is who. If Netscape insists this is them, that's clearly a huge landgrab, nobody will buy it and SSL will be dead. But what if they out-source it to these companies called Certificate Authorities, that do the same sort of thing already for products in the banking and legal industries? So initially, a CA is a big company like Verisign that already has a business checking people's identities, and this is a new side to it, they don't spin up all new infrastructure, they just make a web page on this new-fangled World Wide Web saying they can offer "SSL certificates". They are verifying real world identities because an "Internet identity" is still a pretty new idea for them. Now, these certs were expensive, and there was of course a pressure to find a way to make a product that was cheaper - not for customers, who cares what it costs customers? No, cheaper to make, so you could keep more profit. And the solution was "Domain validated" certificates. Gradually CAs began writing "Domain validated" in the slots where it should say e.g. the Organization name of the subject, and just sending an email out to "validate" that they really controlled a domain. EV as you know it today comes into being much later, only about a decade ago, as the Browser Vendors (by now including Mozilla, the successor to Netscape that was now a not-for-profit and a pretty angry pro-user one) realised that a Wild West of certificates issued by CAs wasn't in their interests.

>CAs built their business on the idea that we needed to know that sears.com is Sears, Roebuck & Co., while sears.net is a family website What do you mean? This is only true for EV certs.

tialaramex 9y ago

To be fair, CAs are somewhat _older_ than the Web PKI and even the Web PKI starts out with what you'd now think of as the EV model. In the early 1990s Tim's ludicrous toy hypertext system is suddenly the New Hotness and people who had barely grasped by Email was a good idea are starting to realise that maybe this whole Internet thing might not be a temporary phase before we all settle down to using AOL (yes, AOL used to be its own thing not just an obscure corner of the Internet) A graphical web browser called Mosaic has been invented by (of all things) the National Centre for Supercomputing to make Tim's crazy toy a riot of pictures as well as text, linked together over the Internet, and some of the people who worked on that, plus a whole lot of other good software engineers hired from other work are now at this startup which is initially also named "Mosaic" but eventually becomes famous to us as "Netscape" before the Microsoft corporation drives it out of business. Anyway, at Netscape they're more focused on commercially friendly applications of this technology than the academics who've worked on it before, and one thing they realise is that Tim (being a physicist not really a software engineer or computer scientist) hasn't built any workable security into this thing. So they invent a Secure Socket Layer, the idea is to use all the same stuff as the Web except with Cryptography to protect it. Nobody working on this stuff is a serious cryptographer, but they do eventually cobble together something that isn't laughable, on their second attempt, SSLv2. One of the fixes they realise they need is that encrypting data to just some random yahoo on the Internet is pointless - bad guys can just arrange to be Man-in-the-middle and you've got to stop that. So somebody needs to take responsibility for figuring out who is who. If Netscape insists this is them, that's clearly a huge landgrab, nobody will buy it and SSL will be dead. But what if they out-source it to these companies called Certificate Authorities, that do the same sort of thing already for products in the banking and legal industries? So initially, a CA is a big company like Verisign that already has a business checking people's identities, and this is a new side to it, they don't spin up all new infrastructure, they just make a web page on this new-fangled World Wide Web saying they can offer "SSL certificates". They are verifying real world identities because an "Internet identity" is still a pretty new idea for them. Now, these certs were expensive, and there was of course a pressure to find a way to make a product that was cheaper - not for customers, who cares what it costs customers? No, cheaper to make, so you could keep more profit. And the solution was "Domain validated" certificates. Gradually CAs began writing "Domain validated" in the slots where it should say e.g. the Organization name of the subject, and just sending an email out to "validate" that they really controlled a domain. EV as you know it today comes into being much later, only about a decade ago, as the Browser Vendors (by now including Mozilla, the successor to Netscape that was now a not-for-profit and a pretty angry pro-user one) realised that a Wild West of certificates issued by CAs wasn't in their interests.