3 ms·

It's been obvious to me for quite a while that EV etc only really tells you "this person paid $$$ to get a cert" rather than anything about the site being trust

It's been obvious to me for quite a while that EV etc only really tells you "this person paid $$$ to get a cert" rather than anything about the site being trustworthy or being who it says it is. I wouldn't bat an eye if 10 years from now major browsers distrusted everything but letsencrypt. Once the letsencrypt project comes out with a comparable solution for code signing, there is really no more reason for paid cert companies to exist. They don't check shit and it's super easy to get fraudulent certs so the value of what they provide is $0.

majewsky 8y ago
I would bat an eye because it's never good to rely on a single point of failure. Imagine, for instance, that at some point, LE is the only trusted CA for code-signing. If its root key gets compromised for some reason, how are we supposed to move to a new CA if the auto-updaters cannot trust the old CA anymore?
- sam0x17 8y ago
  True. They should maybe consider breaking up their operation into 20 or so root certs.
  - sterlind 8y ago
    As much as I'm tempted to agree, decentralization perhaps risks even more. Opsec compromise is only one SPOF for a signing service; the state might coerce the CA into handing over the keys or issuing an intermediate for MitM. Do you shard across 20 nations? If so, you have to contend with 20 intelligence agencies. It might make more sense to keep all the eggs in one basket, and have new baskets ready to go if a canary triggers.
lifthrasiir 8y ago
I strongly agree to the conclusion but not the logic. It is an entirely possible situation that while EV indeed is a CV's scheme to earn more $$$ users do care and as a result the user security does improve (most possibly, only a bit though). My own conclusion results from the observation that, well, users don't; see an account [1] from Troy Hunt (of the HaveIBeenPwned fame) for example. [1] https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas-phishing-lets-encrypt/ https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas...
Enverex 8y ago
Have you ever actually bought an EV certificate? I work for a company that sells them and therefore I have to deal with the process and there are a lot of checks. "They don't check shit" is complete nonsense.

majewsky 8y ago

I would bat an eye because it's never good to rely on a single point of failure. Imagine, for instance, that at some point, LE is the only trusted CA for code-signing. If its root key gets compromised for some reason, how are we supposed to move to a new CA if the auto-updaters cannot trust the old CA anymore?

sam0x17 8y ago
True. They should maybe consider breaking up their operation into 20 or so root certs.
- sterlind 8y ago
  As much as I'm tempted to agree, decentralization perhaps risks even more. Opsec compromise is only one SPOF for a signing service; the state might coerce the CA into handing over the keys or issuing an intermediate for MitM. Do you shard across 20 nations? If so, you have to contend with 20 intelligence agencies. It might make more sense to keep all the eggs in one basket, and have new baskets ready to go if a canary triggers.

lifthrasiir 8y ago

I strongly agree to the conclusion but not the logic. It is an entirely possible situation that while EV indeed is a CV's scheme to earn more $$$ users do care and as a result the user security does improve (most possibly, only a bit though). My own conclusion results from the observation that, well, users don't; see an account [1] from Troy Hunt (of the HaveIBeenPwned fame) for example. [1] https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas-phishing-lets-encrypt/ https://www.troyhunt.com/on-the-perceived-value-ev-certs-cas...

Enverex 8y ago

Have you ever actually bought an EV certificate? I work for a company that sells them and therefore I have to deal with the process and there are a lot of checks. "They don't check shit" is complete nonsense.