3 ms·

Let's Encrypt's argument for why all the fancy features that CA's offered boiled down to "These are more complicated ways of proving that you own a domain". So

Let's Encrypt's argument for why all the fancy features that CA's offered boiled down to "These are more complicated ways of proving that you own a domain". So by automating the verification of ownership of a domain you could essentially run a CA for pennies per certificate, and give them out for free. Looking at application development I think a similar thing could be done, but what would we pin identity to? I don't know if there is one thing that every app has like a website.

DaiPlusPlus 6y ago
Registered company information and/or notarised identity cards.
benlivengood 6y ago
> Looking at application development I think a similar thing could be done, but what would we pin identity to? How about domain name? Whenever I install (Windows) software I rarely care about the mailing address or D.B.A. name; I look at the website address listed.
- gruez 6y ago
  A domain name costs less than a dollar. A DBA or real-life identity cost significantly more. In addition, if I'm getting my software over the internet (99.99% of the cases), I'm already verifying the domain name via the browser (via tls), so it's not adding any additional security. If the server was hacked, the attacker can mint himself a new certificate and you won't be able to tell.
  - benlivengood 6y ago
    microsoft.com or debian.org would cost a lot more than $1 and I would trust signed or unsigned software downloaded from either a lot more than from a random domain name. Code-signing definitely adds the benefit of offline key management; there is less risk of signing keys being stolen than TLS keys. But the valuation of trust is rooted in the domain; if Debian has to revoke all their keys for some reason I'll trust debian.org over any other source for re-establishing a root of trust unless a significant fraction of the Internet and mailing lists are crying foul, and even then I would probably wait for control of debian.org to be settled before trusting any Debian repositories. I still think that demonstrated control of a domain is sufficient for verifying a code-signing identity, even automatically like LetsEncrypt does for TLS.
notatoad 6y ago
>I don't know if there is one thing that every app has like a website. in order to have your code signed right now, you have to purchase a signing certificate. so we're already enforcing a "you have to buy this thing to have your code signed" rule. there's no reason that thing you have to purchase couldn't be a domain name instead - it's no more onerous than making the developer purchase a cert, but 99% would already have one.

DaiPlusPlus 6y ago

Registered company information and/or notarised identity cards.

benlivengood 6y ago

> Looking at application development I think a similar thing could be done, but what would we pin identity to? How about domain name? Whenever I install (Windows) software I rarely care about the mailing address or D.B.A. name; I look at the website address listed.

gruez 6y ago
A domain name costs less than a dollar. A DBA or real-life identity cost significantly more. In addition, if I'm getting my software over the internet (99.99% of the cases), I'm already verifying the domain name via the browser (via tls), so it's not adding any additional security. If the server was hacked, the attacker can mint himself a new certificate and you won't be able to tell.
- benlivengood 6y ago
  microsoft.com or debian.org would cost a lot more than $1 and I would trust signed or unsigned software downloaded from either a lot more than from a random domain name. Code-signing definitely adds the benefit of offline key management; there is less risk of signing keys being stolen than TLS keys. But the valuation of trust is rooted in the domain; if Debian has to revoke all their keys for some reason I'll trust debian.org over any other source for re-establishing a root of trust unless a significant fraction of the Internet and mailing lists are crying foul, and even then I would probably wait for control of debian.org to be settled before trusting any Debian repositories. I still think that demonstrated control of a domain is sufficient for verifying a code-signing identity, even automatically like LetsEncrypt does for TLS.

notatoad 6y ago

>I don't know if there is one thing that every app has like a website. in order to have your code signed right now, you have to purchase a signing certificate. so we're already enforcing a "you have to buy this thing to have your code signed" rule. there's no reason that thing you have to purchase couldn't be a domain name instead - it's no more onerous than making the developer purchase a cert, but 99% would already have one.