8 ms·

Step One: Google becomes a CA with a large fanfair and covered in every tech blog Step Two: Google's entry makes the incumbents either decide to exit the space

Step One: Google becomes a CA with a large fanfair and covered in every tech blog Step Two: Google's entry makes the incumbents either decide to exit the space or change their bad behavior Step Three: Google exits the space accomplishing their mission and screwing over whoever uses their services. I really hope that it doesn't end like above but I think this will go the way of Google Fiber. Or maybe this is a play for their cloud services to also have be a CA like Amazon.

magicalist 8y ago
> Step Two: Google's entry makes the incumbents either decide to exit the space or change their bad behavior Yes, we wouldn't want the price of certificates to enter a race to the bottom. Let's Encrypt relies on that revenue! Honestly these comments...
- psergeant 8y ago
  The comment you’re replying to thinks Step Two is good, but feels a bad Step Three is inevitable.
  - magicalist 8y ago
    Why would existing CAs leave the market if they didn't before?
    - geofft 8y ago
      I think the argument is that existing CAs with mediocre practices are currently profitable, but in the presence of Google competition will stop being profitable and decide to exit, and may not decide to return if Google leaves. (I don't think the scenario as a whole seems likely, but this specific argument is analogous to e.g. concerns about Uber and Lyft competing with taxies on VC-subsidized pricing that will run out one day, or the loss of SF laundromats thanks to laundry startups.)
      - magicalist 8y ago
        Except, again, there are sponsored non-profits in this space. What further distortion do you expect?
        askmike 8y ago
        LE is great for a lot of things. But it doesn't offer the wide range of SSL certs everyone requires, such as OV and EV certs.
        tialaramex 8y ago
        Google did not request and were not granted EV treatment for this CA. So even if it mints certificates with an EV OID in them that will get ignored in Firefox. Although the Google CA, Google's root trust programme, and the Chrome TLS implementation people are three distinct teams at Google, common sentiment among the technically savvy (which would include all three groups) is that EV is either entirely or largely pointless and nobody cares, so it would not make sense to request EV treatment. Your general thrust is right, there are other things CAs issue that Let's Encrypt does not, but the numbers still tell a story of solid growth even in the Web PKI, Let's Encrypt grew the market considerably, seizing 75% of a market that is now five times bigger than before doesn't squeeze out other people.
        manquer 8y ago
        Largely pointless to people @ Google is not a good measure. Customers still use it, and are willing to pay for it.
        tialaramex 8y ago
        Customers still use and are willing to pay for homeopathy, but since it's ineffective my doctor doesn't offer it. Google knows EV is basically snake oil, so why sell it? I appreciate that there's a certain level of anarcho-capitalist sentiment in Hacker News, but lots of people run for-profit businesses that don't take the "If there's any possible way to make money, no matter how reprehensible, I will do that" approach. If you just can't stand for any for-profit business to ever do anything except to make as much money as possible, let me offer you a (very weak) economic justification you can cling to instead: Offering EV means you need to build a fairly complicated customer services operation, maybe a call center with verification specialists, a whole new team of people with skills your company doesn't have today. It is very unlikely that Google can make more profit on this weird niche business than by spending the same resources on, say, a minor improvement to advertising revenue. There, Anarcho-capitalists, do you feel all safe and cosy in the knowledge that if you squint you can pretend it was all just about money?
jchw 8y ago
Yeah I doubt this. I don't know what exactly Google's PKI will be for but to me this seems like a close relative of Google Cloud (esp. DNS) and Google Domains. Also, similar infrastructure services from Google, like Google's public DNS resolver, show no signs of being turned down. (Disclaimer: I am a Google employee, but I don't work on any of this.)
- psergeant 8y ago
  Are Cloud and Domains special-case product protected from closure? How do I as an outsider know which Google products have this protection?
  - fragmede 8y ago
    Hell, I bet there are insiders who were surprised about the decision to close up shop on Google Inbox. There's no guarantee that Cloud and Domains will never be closed, but that's on the level of RIM no longer making Blackberries. Google's a modern Internet company and has bet, and bet big, on being a leading cloud services provider, and Domains are a key component to having a vertically integrated offering. Google is a public company and as such they are required to release certain information in annual report, so their investment in the cloud is verifiable.
    - eh78ssxv2f 8y ago
      > Hell, I bet there are insiders who were surprised about the decision to close up shop on Google Inbox. Not an insider, but TBH, I was always pretty much sure that one of Gmail or Inbox will go away soon. With Gmail having more user base, it was natural for Inbox to be subsumed by gmail. Inbox was not really fundamentally different from Gmail. It offered some new features, but I can't imagine that it would be too hard to implement them in Gmail too (e.g., snooze feature).
      - lexicality 8y ago
        > Inbox was not really fundamentally different from Gmail. I disagree, and suspect that anyone else that used custom bundles would too. This guy sums it up well: https://www.androidpolice.com/2018/09/12/google-may-push-people-gmail-bad-substitute-inbox/ https://www.androidpolice.com/2018/09/12/google-may-push-peo...
Dylan16807 8y ago
I don't understand why step 2 would happen, but burning off 90% of the existing roots would be a good thing.
ubernostrum 8y ago
The power play in the CA world has already happened, with the major browser and operating-system vendors -- using their position as gatekeepers of the root certificate stores for the overwhelming majority of devices as leverage -- working to clean up a lot of the historical bad behavior. Also, any unilateral move by Google would have to get past the rest of the CAB, which includes Apple, Microsoft and Mozilla, who all control significant root certificate stores.
- ocdtrekkie 8y ago
  An EFF member has tried to convince me that Google is subject to the whims of the CAB, but failed to explain to me how. Google's Root CA policy doesn't mention the CAB, and specifically provides Google's own authority to remove CAs as it sees fit. Whether or not Mozilla, Microsoft, or Apple follow suit, if Google were to chose to distrust a CA, such as they did with Symantec, due to Chrome's 60%+ market share, that CA is out of business, regardless of what any other browser vendor says on the matter. Whether or not the other vendors choose to follow suit doesn't change the fact that the CAB has no legal authority over Google, and Google is a significant majority of the browser market.
  - ubernostrum 8y ago
    You just shifted the goalpost. Google's going to maintain a root store either way. The parent I replied to was worried that Google becoming a CA would be a power play to eliminate all other CAs and then Google would get out of the business. Apple, Microsoft and Mozilla have the power to drop Google's CA from their root stores and make Google-issued certs worthless on a huge number of devices worldwide, which is how they act as a balance against unilateral moves by Google-the-CA.
    - ocdtrekkie 8y ago
      Would Mozilla be able to risk being the browser that can't access Google services? I am not sure that's a realistic scenario for any of the major browser vendors. But arguably if Google's Root CA were never to gain multi-browser support in the first place, they'd never be able to launch their service to begin with. I don't think Google would "embrace, extend, extinguish" the CA market though as the parent suggested, the CA system gives Google a massive amount of control of the Internet at large, and I can't fathom them giving it up.
sjellis 8y ago
Now that SSL is effectively mandatory for every HTTP application, cloud providers will all either have to become CAs, or integrate with an external CA like Let's Encrypt. The existence of LE provides an alternative to commercial and potentially hosting-specific CAs, so a Google CA isn't going to wreck the market. Except for the existing commercial providers who change large fees for not much.

magicalist 8y ago

> Step Two: Google's entry makes the incumbents either decide to exit the space or change their bad behavior Yes, we wouldn't want the price of certificates to enter a race to the bottom. Let's Encrypt relies on that revenue! Honestly these comments...

psergeant 8y ago
The comment you’re replying to thinks Step Two is good, but feels a bad Step Three is inevitable.
- magicalist 8y ago
  Why would existing CAs leave the market if they didn't before?
  - geofft 8y ago
    I think the argument is that existing CAs with mediocre practices are currently profitable, but in the presence of Google competition will stop being profitable and decide to exit, and may not decide to return if Google leaves. (I don't think the scenario as a whole seems likely, but this specific argument is analogous to e.g. concerns about Uber and Lyft competing with taxies on VC-subsidized pricing that will run out one day, or the loss of SF laundromats thanks to laundry startups.)
    - magicalist 8y ago
      Except, again, there are sponsored non-profits in this space. What further distortion do you expect?
      - askmike 8y ago
        LE is great for a lot of things. But it doesn't offer the wide range of SSL certs everyone requires, such as OV and EV certs.
        tialaramex 8y ago
        Google did not request and were not granted EV treatment for this CA. So even if it mints certificates with an EV OID in them that will get ignored in Firefox. Although the Google CA, Google's root trust programme, and the Chrome TLS implementation people are three distinct teams at Google, common sentiment among the technically savvy (which would include all three groups) is that EV is either entirely or largely pointless and nobody cares, so it would not make sense to request EV treatment. Your general thrust is right, there are other things CAs issue that Let's Encrypt does not, but the numbers still tell a story of solid growth even in the Web PKI, Let's Encrypt grew the market considerably, seizing 75% of a market that is now five times bigger than before doesn't squeeze out other people.
        manquer 8y ago
        Largely pointless to people @ Google is not a good measure. Customers still use it, and are willing to pay for it.
        tialaramex 8y ago
        Customers still use and are willing to pay for homeopathy, but since it's ineffective my doctor doesn't offer it. Google knows EV is basically snake oil, so why sell it? I appreciate that there's a certain level of anarcho-capitalist sentiment in Hacker News, but lots of people run for-profit businesses that don't take the "If there's any possible way to make money, no matter how reprehensible, I will do that" approach. If you just can't stand for any for-profit business to ever do anything except to make as much money as possible, let me offer you a (very weak) economic justification you can cling to instead: Offering EV means you need to build a fairly complicated customer services operation, maybe a call center with verification specialists, a whole new team of people with skills your company doesn't have today. It is very unlikely that Google can make more profit on this weird niche business than by spending the same resources on, say, a minor improvement to advertising revenue. There, Anarcho-capitalists, do you feel all safe and cosy in the knowledge that if you squint you can pretend it was all just about money?

jchw 8y ago

Yeah I doubt this. I don't know what exactly Google's PKI will be for but to me this seems like a close relative of Google Cloud (esp. DNS) and Google Domains. Also, similar infrastructure services from Google, like Google's public DNS resolver, show no signs of being turned down. (Disclaimer: I am a Google employee, but I don't work on any of this.)

psergeant 8y ago
Are Cloud and Domains special-case product protected from closure? How do I as an outsider know which Google products have this protection?
- fragmede 8y ago
  Hell, I bet there are insiders who were surprised about the decision to close up shop on Google Inbox. There's no guarantee that Cloud and Domains will never be closed, but that's on the level of RIM no longer making Blackberries. Google's a modern Internet company and has bet, and bet big, on being a leading cloud services provider, and Domains are a key component to having a vertically integrated offering. Google is a public company and as such they are required to release certain information in annual report, so their investment in the cloud is verifiable.
  - eh78ssxv2f 8y ago
    > Hell, I bet there are insiders who were surprised about the decision to close up shop on Google Inbox. Not an insider, but TBH, I was always pretty much sure that one of Gmail or Inbox will go away soon. With Gmail having more user base, it was natural for Inbox to be subsumed by gmail. Inbox was not really fundamentally different from Gmail. It offered some new features, but I can't imagine that it would be too hard to implement them in Gmail too (e.g., snooze feature).
    - lexicality 8y ago
      > Inbox was not really fundamentally different from Gmail. I disagree, and suspect that anyone else that used custom bundles would too. This guy sums it up well: https://www.androidpolice.com/2018/09/12/google-may-push-people-gmail-bad-substitute-inbox/ https://www.androidpolice.com/2018/09/12/google-may-push-peo...

Dylan16807 8y ago

I don't understand why step 2 would happen, but burning off 90% of the existing roots would be a good thing.

ubernostrum 8y ago

The power play in the CA world has already happened, with the major browser and operating-system vendors -- using their position as gatekeepers of the root certificate stores for the overwhelming majority of devices as leverage -- working to clean up a lot of the historical bad behavior. Also, any unilateral move by Google would have to get past the rest of the CAB, which includes Apple, Microsoft and Mozilla, who all control significant root certificate stores.

ocdtrekkie 8y ago
An EFF member has tried to convince me that Google is subject to the whims of the CAB, but failed to explain to me how. Google's Root CA policy doesn't mention the CAB, and specifically provides Google's own authority to remove CAs as it sees fit. Whether or not Mozilla, Microsoft, or Apple follow suit, if Google were to chose to distrust a CA, such as they did with Symantec, due to Chrome's 60%+ market share, that CA is out of business, regardless of what any other browser vendor says on the matter. Whether or not the other vendors choose to follow suit doesn't change the fact that the CAB has no legal authority over Google, and Google is a significant majority of the browser market.
- ubernostrum 8y ago
  You just shifted the goalpost. Google's going to maintain a root store either way. The parent I replied to was worried that Google becoming a CA would be a power play to eliminate all other CAs and then Google would get out of the business. Apple, Microsoft and Mozilla have the power to drop Google's CA from their root stores and make Google-issued certs worthless on a huge number of devices worldwide, which is how they act as a balance against unilateral moves by Google-the-CA.
  - ocdtrekkie 8y ago
    Would Mozilla be able to risk being the browser that can't access Google services? I am not sure that's a realistic scenario for any of the major browser vendors. But arguably if Google's Root CA were never to gain multi-browser support in the first place, they'd never be able to launch their service to begin with. I don't think Google would "embrace, extend, extinguish" the CA market though as the parent suggested, the CA system gives Google a massive amount of control of the Internet at large, and I can't fathom them giving it up.

sjellis 8y ago

Now that SSL is effectively mandatory for every HTTP application, cloud providers will all either have to become CAs, or integrate with an external CA like Let's Encrypt. The existence of LE provides an alternative to commercial and potentially hosting-specific CAs, so a Google CA isn't going to wreck the market. Except for the existing commercial providers who change large fees for not much.