5 ms·

>An evil CA can of course generate fake certificates for any hostname they like, but those people already exist [citation needed] If that were true, I'd expec

by panny 7y ago

>An evil CA can of course generate fake certificates for any hostname they like, but those people already exist [citation needed] If that were true, I'd expect browser/OS makers to promptly revoke trusted CA status for them.

ohyeshedid 7y ago
Promptly meaning as soon as they find out, which is likely nearly instant these days for large services. Comodo issued bogus certs, so did MCS. It's happened a few times over the years.
hawkice 7y ago
Only if they abused it. If it's a government CA, and they use it only to trap pedophiles and ISIL, I don't see them doing anything.
- comex 7y ago
  I’m pretty sure browsers will de-trust CAs that intentionally sign forged certificates regardless of what they’re used for.
- tracker1 7y ago
  Only pedophiles and ISIL need encryption, so what are you worried about... just do all your banking etc. over plain HTTP... I'm sure no foreign governments are listening on ANY compromised devices in the middle, or have any motivations you disagree with.
Thorrez 7y ago
>promptly It takes a very long time to revoke trust if you don't want to break the web. Symantec was discovered to have misissued a bunch of certs in 2015[1] (including for google.com). No one removed trust for them. Then in Jan 2017 it was discovered they misissued a bunch more[2]. I believe it was the end of 2018 before browsers finally removed trust for them. [1] https://security.googleblog.com/2015/10/sustaining-digital-certificate-security.html https://security.googleblog.com/2015/10/sustaining-digital-c... [2] https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html https://security.googleblog.com/2017/09/chromes-plan-to-dist...
- panny 7y ago
  I believe you've confirmed mpoteat's fears are well founded. Thanks for doing that for me ;) Here's your upboat.
squiggleblaz 7y ago
I think you misinterpreted. An evil CA can generate fake certificates, because a CA can sign (generate) any certificate they want, because all they're doing is saying "this is legit, trust me". People with the power to generate fake certificates for any hostname already exist regardless of the size of Lets Encrypt. Consequently LE aren't a particular threat. (And the short lifespan of LE certs significantly reduces the value of them as a target. Once the dodginess is identified, you could detrust them within a much shorter timeframe)

by panny 7y ago

ohyeshedid 7y ago

Promptly meaning as soon as they find out, which is likely nearly instant these days for large services. Comodo issued bogus certs, so did MCS. It's happened a few times over the years.

hawkice 7y ago

Only if they abused it. If it's a government CA, and they use it only to trap pedophiles and ISIL, I don't see them doing anything.

comex 7y ago
I’m pretty sure browsers will de-trust CAs that intentionally sign forged certificates regardless of what they’re used for.
tracker1 7y ago
Only pedophiles and ISIL need encryption, so what are you worried about... just do all your banking etc. over plain HTTP... I'm sure no foreign governments are listening on ANY compromised devices in the middle, or have any motivations you disagree with.

Thorrez 7y ago

>promptly It takes a very long time to revoke trust if you don't want to break the web. Symantec was discovered to have misissued a bunch of certs in 2015[1] (including for google.com). No one removed trust for them. Then in Jan 2017 it was discovered they misissued a bunch more[2]. I believe it was the end of 2018 before browsers finally removed trust for them. [1] https://security.googleblog.com/2015/10/sustaining-digital-certificate-security.html https://security.googleblog.com/2015/10/sustaining-digital-c... [2] https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html https://security.googleblog.com/2017/09/chromes-plan-to-dist...

panny 7y ago
I believe you've confirmed mpoteat's fears are well founded. Thanks for doing that for me ;) Here's your upboat.

squiggleblaz 7y ago

I think you misinterpreted. An evil CA can generate fake certificates, because a CA can sign (generate) any certificate they want, because all they're doing is saying "this is legit, trust me". People with the power to generate fake certificates for any hostname already exist regardless of the size of Lets Encrypt. Consequently LE aren't a particular threat. (And the short lifespan of LE certs significantly reduces the value of them as a target. Once the dodginess is identified, you could detrust them within a much shorter timeframe)