4 ms·
> I personaly cannot think of a good reason they do this. Maybe they argue that they don't trust any CA Authorities other than themselves They do it precisely
by eadmund 9y ago
> I personaly cannot think of a good reason they do this. Maybe they argue that they don't trust any CA Authorities other than themselves
They do it precisely because they cannot trust any other CAs. You cannot trust any CAs — and yet you do. Go into your browser: odds are you have CAs controlled by the Russian, Chinese & Turkish governments. You're not just trusting those CAs to issue certificates for .cn, .ru or .tr: you're trusting them for every TLD in the world, to include .com, .gov & .mil. Yes, if you're using XPKI (the standard PKI basically everything on the Internet uses), you're trusting that the Chinese government will never man-in-the-middle your sessions with the IRS. The DoD (rather wisely) chooses to trust only itself to certify itself.
My own opinion is that what we should have done was adopt a system which leveraged DNS to delegate trust (note that this is what Let's Encrypt does), and that we should have rooted DNS in a multinational board: if the U.S., China, Russia, Iran, the United Kingdom, the Ukraine, France & Mexico all agree on something, it's really very likely to be true.
We should also have leveraged IP assignments. Imagine if when you talked to a system it produced proof that it really is allowed to have its IP address and that it really is allowed to speak for a particular domain. That's really what people want, not some sort of nebulous tie to a real-world identity. What we care about is that facebook.com is facebook.com, not that it's Facebook, Inc., headquartered in Menlo Park.
- imglorp 9y agoUntil that time we have a multinational board controlled CA, is there a list somewhere of the "sensible subset" of browser certs, for various types of users?
- more_pylons 9y agoFair point, I didn't really consider the issue with the other CAs that are currently trusted. Isn't it a double edge sword though with what they chose to do instead? By the DoD using their own CA people accessing their sites externally or on non-DoD devices cannot reliably know if they're being ease dropped on either. It has it's benefits for DoD employees using DoD devices but anyone outside the DoD needs to roll the dice or first request the CA root cert from a DoD employee?
- solatic 9y ago99%+ of DoD traffic will be from DoD-managed endpoints, which will be managed and have the DoD CA certificates installed. The DoD use case doesn't typically require them to cater to outside users, with possible exceptions for things like recruiting, which can be handled on separate networks.
- more_pylons 9y agoI've personally been on support screen sharing conferences with the DoD before as a third-party consultant/contractor. They do not provide all contractors, especially third party, with DoD managed devices and in those cases I always thought that it was a bad practice. I asked for the people on the conference to e-mail me the root CA cert to validate the thumbprint was the same as the site but I'm not sure everyone would do that and instead blindly choose the 'proceed anyways' option. /edit. That was a very long time ago though so I'm not sure if they're even using that same screen sharing site anymore or if they've since changed it to use a public CA root cert.