4 ms·

This should be a state provided service. Or provided by the UN. Essential stuff like this or root DNS should be a planetary responsibility.

privateSFacct 7y ago
Just what we need is to get politicians involved in this. One benefit thought would be they could more easily block access to sites they don't want folks visiting by just denying a CA cert (which would then generate warnings / blocking in many browsers).
- giggles_giggles 7y ago
  One benefit? Did you mean to say "the most obvious downside" instead?
  - BiteCode_dev 7y ago
    Ok, the more I read answers to my comment, the less I think it's a good idea.
  - majewsky 7y ago
    Looks like your browser didn't render the <sarcasm> tags.
antoinealb 7y ago
In a lot of countries, giving the government the ability to issue SSL certificates would be a catastrophe in terms of surveillance and censorship.
- BiteCode_dev 7y ago
  Didn't think of that. It doesn't have to be just the state or the UN though. It's not about removing all the other actors on the market. But if I make a website on Python programming in french, I'm quite ok using the french gov as a CA provider. I mean, I trust mozilla because it's mozilla. But I wouldn't trust most companies.
  - vertex-four 7y ago
    The problem is, there’s no way to enforce this. If you are a CA, there is nothing technically stopping you from issuing a certificate for google.com. There’s no infrastructure for the ability to say “this CA is valid only for sites that agree with the risks involved in using it”.
    - iudqnolq 7y ago
      I'm by no means an expert, but I believe Certificate Transparency provides a way to catch that rogue CA after the fact.
      - vertex-four 7y ago
        Only if the certificate authority doesn't implement a way of not submitting their cert to the CT log servers. Of course, eventually someone might notice (if the certificate is used widely enough - if it's used to attack specific known people, maybe not) and realise that a certificate is being served that doesn't have corresponding CT info, but browsers don't check that.
        roblabla 7y ago
        Browser can check that a cert has an equivalent CT Log entry. Chrome does since 2018. https://tools.ietf.org/html/rfc6962#section-3.3 https://tools.ietf.org/html/rfc6962#section-3.3 https://groups.google.com/a/chromium.org/forum/#!msg/ct-policy/wHILiYf31DE/iMFmpMEkAQAJ https://groups.google.com/a/chromium.org/forum/#!msg/ct-poli...
        tialaramex 7y ago
        The ct-policy link you gave and that section of RFC 6962 are about SCTs. The existence of the Signed Certificate Timestamp does not prove the certificate was actually logged, it just proves that the Log promises to log this certificate within the Maximum Merge Delay (24 hours in the case of the Web PKI). A log might in fact be lying or have suffered a grave technical problem. Figuring out how best to have browsers check the logs are truly accurate while preserving user privacy (e.g. obviously if you call a log to ask "Did you log this certificate for clown-porn.example ?" it gives them a good idea about your taste in circus-related adult content which you probably don't want them to have) is an ongoing topic of research. With SCT checks you're in very good shape already today - bad guys would need to compromise several distinct entities to successfully pull this off. It's just not quite "Fire and forget" safe yet.
- macinjosh 7y ago
  In all countries, giving the government the ability to issue SSL certificates would be a catastrophe in terms of surveillance and censorship. FTFY
  - schoen 7y ago
    By the way, there have been a number of openly government-operated root CAs in numerous countries for decades. Before I got involved with Let's Encrypt, I was very nervous about government influence in PKI and thought this was quite concerning. (That was also before Certificate Transparency.) A quick look at a root store turns up subject=C = CN, O = China Financial Certification Authority, CN = CFCA EV ROOT subject=C = HK, O = Hongkong Post, CN = Hongkong Post Root CA 1 subject=C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Root CA [and other roots with the same organization] subject=C = TW, O = Government Root Certification Authority I think there are several others, probably especially at the intermediate level.
irrational 7y ago
Oh, you mean like the state provided service that is trying to sell off the .org domain registry right now?
tsukurimashou 7y ago
> planetary responsibility. I would like to hear from the planetary president to see what he has to say about that. Seriously this is all great but unfortunately with all the mess going on with "the big powers" I'm not sure you want to give them that. I wished we lived in a world where we could tho.

privateSFacct 7y ago

Just what we need is to get politicians involved in this. One benefit thought would be they could more easily block access to sites they don't want folks visiting by just denying a CA cert (which would then generate warnings / blocking in many browsers).

giggles_giggles 7y ago
One benefit? Did you mean to say "the most obvious downside" instead?
- BiteCode_dev 7y ago
  Ok, the more I read answers to my comment, the less I think it's a good idea.
- majewsky 7y ago
  Looks like your browser didn't render the <sarcasm> tags.

antoinealb 7y ago

In a lot of countries, giving the government the ability to issue SSL certificates would be a catastrophe in terms of surveillance and censorship.

BiteCode_dev 7y ago
Didn't think of that. It doesn't have to be just the state or the UN though. It's not about removing all the other actors on the market. But if I make a website on Python programming in french, I'm quite ok using the french gov as a CA provider. I mean, I trust mozilla because it's mozilla. But I wouldn't trust most companies.
- vertex-four 7y ago
  The problem is, there’s no way to enforce this. If you are a CA, there is nothing technically stopping you from issuing a certificate for google.com. There’s no infrastructure for the ability to say “this CA is valid only for sites that agree with the risks involved in using it”.
  - iudqnolq 7y ago
    I'm by no means an expert, but I believe Certificate Transparency provides a way to catch that rogue CA after the fact.
    - vertex-four 7y ago
      Only if the certificate authority doesn't implement a way of not submitting their cert to the CT log servers. Of course, eventually someone might notice (if the certificate is used widely enough - if it's used to attack specific known people, maybe not) and realise that a certificate is being served that doesn't have corresponding CT info, but browsers don't check that.
      - roblabla 7y ago
        Browser can check that a cert has an equivalent CT Log entry. Chrome does since 2018. https://tools.ietf.org/html/rfc6962#section-3.3 https://tools.ietf.org/html/rfc6962#section-3.3 https://groups.google.com/a/chromium.org/forum/#!msg/ct-policy/wHILiYf31DE/iMFmpMEkAQAJ https://groups.google.com/a/chromium.org/forum/#!msg/ct-poli...
        tialaramex 7y ago
        The ct-policy link you gave and that section of RFC 6962 are about SCTs. The existence of the Signed Certificate Timestamp does not prove the certificate was actually logged, it just proves that the Log promises to log this certificate within the Maximum Merge Delay (24 hours in the case of the Web PKI). A log might in fact be lying or have suffered a grave technical problem. Figuring out how best to have browsers check the logs are truly accurate while preserving user privacy (e.g. obviously if you call a log to ask "Did you log this certificate for clown-porn.example ?" it gives them a good idea about your taste in circus-related adult content which you probably don't want them to have) is an ongoing topic of research. With SCT checks you're in very good shape already today - bad guys would need to compromise several distinct entities to successfully pull this off. It's just not quite "Fire and forget" safe yet.
macinjosh 7y ago
In all countries, giving the government the ability to issue SSL certificates would be a catastrophe in terms of surveillance and censorship. FTFY
- schoen 7y ago
  By the way, there have been a number of openly government-operated root CAs in numerous countries for decades. Before I got involved with Let's Encrypt, I was very nervous about government influence in PKI and thought this was quite concerning. (That was also before Certificate Transparency.) A quick look at a root store turns up subject=C = CN, O = China Financial Certification Authority, CN = CFCA EV ROOT subject=C = HK, O = Hongkong Post, CN = Hongkong Post Root CA 1 subject=C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Root CA [and other roots with the same organization] subject=C = TW, O = Government Root Certification Authority I think there are several others, probably especially at the intermediate level.

irrational 7y ago

Oh, you mean like the state provided service that is trying to sell off the .org domain registry right now?

tsukurimashou 7y ago

> planetary responsibility. I would like to hear from the planetary president to see what he has to say about that. Seriously this is all great but unfortunately with all the mess going on with "the big powers" I'm not sure you want to give them that. I wished we lived in a world where we could tho.