3 ms·
Devil's advocate: HTTPS centralizes the web around big players. The CA trust model gives a privileged few the right to say what websites are "secure", even in c
by zelly 7y ago
Devil's advocate: HTTPS centralizes the web around big players. The CA trust model gives a privileged few the right to say what websites are "secure", even in cases where no user input goes down the wire. "Not Secure" in the top left brands and shames amateurs. Come on, just make a Medium page! You should be posting this on a FAANG property! Let's Encrypt is great, but don't forget that it could disappear overnight--after every browser started de facto blocking non-HTTPS traffic.
- jagged-chisel 7y agoHow does Let's Encrypt fit into this? Are they part of the 'privileged few?' Can we trust part of The Few more than other parts?
- zelly 7y agoThey have even more power than the paid ones, because the most of sites they secure wouldn't/couldn't get a paid cert if Let's Encrypted disappeared or refused to serve them. At least the customers of paid ones could just move their billing to another service.
- iso947 7y agoI would be more comfortable if there were several acme based free certificate providers However I’m far more concerned about chrome, and the attitude of so many in the biz that think Firefox should be mothballed.
- tialaramex 7y agoThe Web PKI in theory is subject to oversight by all the big trust stores which is roughly the set of operating vendors except Mozilla instead of the Free Unixes (and less importantly Oracle because Java is as usual special). But in practice over many years of involvement my observation would be that the only thing which matters is Mozilla. At the others such oversight is opaque and whilst opacity might mask a hive of frantic activity it's also what doing nothing would look like from outside such a corporation. But at Mozilla it's done in public, where you can participate if this idea of a "privileged few" bothers you. And so again, I can't prove Microsoft doesn't have loads of smart people dedicated to this problem, but I can tell you that their actions in the period I've been paying attention look exactly how I'd predict from two inputs: Government scale purchases of Microsoft's product platform (driving trust inclusion in Windows for a variety of governments I wouldn't trust to tell me if it's raining let alone in the CA role) and copy-pasting Mozilla decisions.