3 ms·

I'm lucky enough to still have a job in a crisis. If that weren't the case, then a pet project of mine would be a LetsEncrypt-like service for personal certific

I'm lucky enough to still have a job in a crisis. If that weren't the case, then a pet project of mine would be a LetsEncrypt-like service for personal certificates. Certificates you could install in your browser for TLS authentication, and some templates and examples showing how to configure nginx to authorize clients using one. I imagine email would be pretty similar. I'm just not as familiar with how to configure email clients to use certificates.

floatingatoll 7y ago
There were several free SMIME certificate providers, who would issue you a personal certificate verifying that you control a given email address. Most have shutdown their free products in the past few years, I suspect as a result of having to invest money in their decades-old web applications that no longer function correctly in modern browsers. One remains, but this blog post warns that they practice unsafe private key practices, so I'm inclined to suggest that none do. https://davidroessli.com/logs/2019/09/free-smime-certificates-in-2019/ https://davidroessli.com/logs/2019/09/free-smime-certificate...
WorldMaker 7y ago
"LetsEncryptEmail" sounds like a good idea. It seems like there would be lessons to learn from Mozilla's Persona / BrowserID project which followed similar goals at a technical level. For instance, in addition to falling back to OTP codes sent to an email address for verification, they had a reasonably smart idea that you could use OIDC ("OpenID Connect") to validate logins more directly to at least major email providers like Gmail and Yahoo since many of the majors do have an OIDC endpoint or two. (Mozilla Persona was a great project idea and a shame it never got enough market share. It didn't end up using personal certificates, though IIRC they explored that as an option and what they did use was technically very close.)
jamieweb 7y ago
I remember reading about Individual Validation (IV) certificates, which I believe were similar to Extended Validation (EV) certificates, but for individuals. I don't think they ever really took off (or even existed), and there isn't anything in the Baseline Requirements / EV Guidelines as far as I know. Nowadays they seem to be a bit of a myth, as there is very little evidence of them online except for use in code signing.
tialaramex 7y ago
In principle nothing stops you creating such a CA. The problem is, nothing stops anybody else creating such a CA. Why should I trust either of them? Why should anybody? Unless a critical mass trust the same CAs it's hopeless. What you need there is a PKI, a Public Key Infrastructure. A PKI has two components, firstly some technical agreements like what sort of certificates are used, how to write email addresses and so on, for which you can mostly rely upon PKIX in this scenario - but then you also need some consensus on the much more difficult and political trust problem. Mostly what happens is that PKIs are relatively small and private. EMV ("Chip and PIN" cards) has its own private PKI managed by EMVCo, the RIRs have one for route management called RPKI, lots of businesses have their own. Apple and Microsoft operate PKIs for "code signing" of various sorts. And there's one obvious public PKI, the Web PKI, which is why your browser agrees with mine that this is https://news.ycombinator.com/ https://news.ycombinator.com/ But there isn't one for email. So the far trickier problem than spinning up some "LetsEncrypt like service for personal certificates" is building that PKI.

floatingatoll 7y ago

There were several free SMIME certificate providers, who would issue you a personal certificate verifying that you control a given email address. Most have shutdown their free products in the past few years, I suspect as a result of having to invest money in their decades-old web applications that no longer function correctly in modern browsers. One remains, but this blog post warns that they practice unsafe private key practices, so I'm inclined to suggest that none do. https://davidroessli.com/logs/2019/09/free-smime-certificates-in-2019/ https://davidroessli.com/logs/2019/09/free-smime-certificate...

WorldMaker 7y ago

"LetsEncryptEmail" sounds like a good idea. It seems like there would be lessons to learn from Mozilla's Persona / BrowserID project which followed similar goals at a technical level. For instance, in addition to falling back to OTP codes sent to an email address for verification, they had a reasonably smart idea that you could use OIDC ("OpenID Connect") to validate logins more directly to at least major email providers like Gmail and Yahoo since many of the majors do have an OIDC endpoint or two. (Mozilla Persona was a great project idea and a shame it never got enough market share. It didn't end up using personal certificates, though IIRC they explored that as an option and what they did use was technically very close.)

jamieweb 7y ago

I remember reading about Individual Validation (IV) certificates, which I believe were similar to Extended Validation (EV) certificates, but for individuals. I don't think they ever really took off (or even existed), and there isn't anything in the Baseline Requirements / EV Guidelines as far as I know. Nowadays they seem to be a bit of a myth, as there is very little evidence of them online except for use in code signing.

tialaramex 7y ago

In principle nothing stops you creating such a CA. The problem is, nothing stops anybody else creating such a CA. Why should I trust either of them? Why should anybody? Unless a critical mass trust the same CAs it's hopeless. What you need there is a PKI, a Public Key Infrastructure. A PKI has two components, firstly some technical agreements like what sort of certificates are used, how to write email addresses and so on, for which you can mostly rely upon PKIX in this scenario - but then you also need some consensus on the much more difficult and political trust problem. Mostly what happens is that PKIs are relatively small and private. EMV ("Chip and PIN" cards) has its own private PKI managed by EMVCo, the RIRs have one for route management called RPKI, lots of businesses have their own. Apple and Microsoft operate PKIs for "code signing" of various sorts. And there's one obvious public PKI, the Web PKI, which is why your browser agrees with mine that this is https://news.ycombinator.com/ https://news.ycombinator.com/ But there isn't one for email. So the far trickier problem than spinning up some "LetsEncrypt like service for personal certificates" is building that PKI.