12 ms·

Bug 647959 – Add Honest Achmed's root certificate

200 points by there 16y ago

Groxx 16y ago
>www.honestachmed.dyndns.org Brilliant.
- krobertson 16y ago
  I tried going there, but the site was down. Damn hackers.
tlrobinson 16y ago
Is this a satirical response to something Mozilla did?
- wmf 16y ago
  It's a commentary on the Comodo hack and the sad state of SSL CAs that led to it: there are too many CAs and their processes are too weak, so what's the harm from one more? http://benlog.com/articles/2011/03/30/intelligently-designing-trust/ http://benlog.com/articles/2011/03/30/intelligently-designin...
- sp332 16y ago
  Not just Mozilla, really the entire CA hierarchy is broken. Everyone's kind of known it for a while, but nothing went majorly wrong until last month: http://arstechnica.com/security/news/2011/03/how-the-comodo-certificate-fraud-calls-ca-trust-into-question.ars http://arstechnica.com/security/news/2011/03/how-the-comodo-...
pnathan 16y ago
Achmed is honest. He even says so. Give him a root cert, certainly errors won't happen more than once, and anyway it would be an honest slip-up.
- thepumpkin1979 16y ago
  Agreed, and it sounds like it will be better than Comodo, I mean, "who knows", let's give it a chance...
bdr 16y ago
This is kind of racist.
- msg 16y ago
  Maybe they weren't thinking much, but the business in the application is "Honest Achmed's Used Cars and Certificates" I think the joke about "honest" comes from the used car salesman bit and the "Achmed" comes from the Iran hack. It is perhaps unfortunate that they came together in a way that sounds like a stereotype about dishonest Arabs (I hadn't heard of this stereotype before reading the thread).
  - xpaulbettsx 16y ago
    I don't think it's particular to Arabs, dishonesty is attributed to any "not them" group by prejudiced people
  - gcb 16y ago
    Car salesman are Dishonest. At last here, more than half of car sales man are of arab origin. Hence that made me laugh and I do not feel like I'm a racist.
- pnathan 16y ago
  Substitute other names, the point remains identical.
  - jessedhillon 16y ago
    Okay. I substitute "Honest Achmed" with "N-word Jim's Southern Signed Certificates". This shouldn't be racist at all, (edit: or if it is racist, it shouldn't matter) since there's a point. edit: There's a reason why it's Achmed, and not "Honest Matthew" or "Honest James".
    - dasil003 16y ago
      Where's the racial slur in Honest Achmed?
adulau 16y ago
For the curious, the procedure for applying to be included as a CA : https://wiki.mozilla.org/CA:How_to_apply https://wiki.mozilla.org/CA:How_to_apply and https://wiki.mozilla.org/CA:Recommended_Practices https://wiki.mozilla.org/CA:Recommended_Practices and the list of included certificate with their audit "certificate: http://www.mozilla.org/projects/security/certs/included/ http://www.mozilla.org/projects/security/certs/included/ or the pending list: http://www.mozilla.org/projects/security/certs/pending/ http://www.mozilla.org/projects/security/certs/pending/ As long as Mr. Honest Achmed is able to provide the appropriate audit certificate...
- gcb 16y ago
  which will be provided by Honest Achmed's Auto Insurance and Audits
  - mtogo 16y ago
    It's turtles all the way down.
ra 16y ago
The problem is that we are forced to trust a particular CA because the company we are dealing with chose to buy their certificate from that particular CA. Whilst PKI provides solutions for this [1], they are not really practical in SSL. In any case, that's not how it works in the real world. In the real world, Achmed's uncles do trust Achmed, and might well trust him to validate the identity of a business partner. In essence, that's the logic behind PGP. What if SSL could be enhanced to allow PGP verification of counterparties? That way anyone could become the equivalent of a root CA, but your value would only be as good as your reputation / integrity. Trusted entities, like the governments, could vouch for the keys of their agencies - or other governments. Friends and Family could vouch for each others keys, businesses for their partners... etc etc. Unlike PKI, PGP would enable counterparties to establish their identiy by having many validating partners (paid and unpaid), as opposed to the one single root CA that is available. As well as bringing the source of trust closer to the relying party (really, I live in Australia, who the hell is Comodo anyway?), the network of trust that would result could be articulated in the browser in many different ways. eg: 25 of your friends and 600 businesses agree that this is the identity of Visa. Twenty years ago this wouldn't have worked. But today, we could use the root CA SSL system to bootstrap a network of trust that becomes independent of the old hierarchy. I hope all that makes sense. [1] eg: certificate revocation, or even the user removing the root CA from her own key store.
- ciupicri 16y ago
  Your proposition is indeed interesting, but let's not forget about the herd mentality. If a more technical savvy user will vouch for a certificate, tens of less technical users might follow and then you'll have the wrong impression about that certificate.
  - T_S_ 16y ago
    You mean like Madoff?
    - ra 16y ago
      More like LinkedIn
hartror 16y ago
All of this talk reminds me of Rainbow's End by Vernor Vinge, a near future novel set in a future where augmented reality is ubiquitous. As part of the climax of the book there is talk of revoking a root certificate which would cause most of European commerce to grid to a halt. Vinge is a computer scientist so the whole thing reads very well from a hacker's perspective. Also it won the Hugo & Locus awards in 2007. Am a big fan. Wikipedia Entry: http://en.wikipedia.org/wiki/Rainbows_End http://en.wikipedia.org/wiki/Rainbows_End Buy it: http://www.amazon.com/Rainbows-End-Vernor-Vinge/dp/0812536363 http://www.amazon.com/Rainbows-End-Vernor-Vinge/dp/081253636...
deleted 16y ago
[deleted]
codeup 16y ago
TLDR for this HN thread: The problem posed by the mix of technical issues and ethnic prejudices in this "bug report" is apparently more complex than what the HN community can deal with. This is a low point for the quality of discussions on HN.
- dschobel 16y ago
  Well put. I cannot imagine what more evidence pg needs for collapsable threads or trigger-happy moderators than that thread.
- skrebbel 16y ago
  true that. which immediately shows how excellent the HN community still is, because i've seen far lower points on every other social site i know. good going, guys!
- JoachimSchipper 16y ago
  When I looked (2 hours after your comment), the top comments were pretty sensible. Looks like downvoting works.

200 points by there 16y ago

Groxx 16y ago

>www.honestachmed.dyndns.org Brilliant.

krobertson 16y ago
I tried going there, but the site was down. Damn hackers.

tlrobinson 16y ago

Is this a satirical response to something Mozilla did?

wmf 16y ago
It's a commentary on the Comodo hack and the sad state of SSL CAs that led to it: there are too many CAs and their processes are too weak, so what's the harm from one more? http://benlog.com/articles/2011/03/30/intelligently-designing-trust/ http://benlog.com/articles/2011/03/30/intelligently-designin...
sp332 16y ago
Not just Mozilla, really the entire CA hierarchy is broken. Everyone's kind of known it for a while, but nothing went majorly wrong until last month: http://arstechnica.com/security/news/2011/03/how-the-comodo-certificate-fraud-calls-ca-trust-into-question.ars http://arstechnica.com/security/news/2011/03/how-the-comodo-...

pnathan 16y ago

Achmed is honest. He even says so. Give him a root cert, certainly errors won't happen more than once, and anyway it would be an honest slip-up.

thepumpkin1979 16y ago
Agreed, and it sounds like it will be better than Comodo, I mean, "who knows", let's give it a chance...

bdr 16y ago

This is kind of racist.

msg 16y ago
Maybe they weren't thinking much, but the business in the application is "Honest Achmed's Used Cars and Certificates" I think the joke about "honest" comes from the used car salesman bit and the "Achmed" comes from the Iran hack. It is perhaps unfortunate that they came together in a way that sounds like a stereotype about dishonest Arabs (I hadn't heard of this stereotype before reading the thread).
- xpaulbettsx 16y ago
  I don't think it's particular to Arabs, dishonesty is attributed to any "not them" group by prejudiced people
- gcb 16y ago
  Car salesman are Dishonest. At last here, more than half of car sales man are of arab origin. Hence that made me laugh and I do not feel like I'm a racist.
pnathan 16y ago
Substitute other names, the point remains identical.
- jessedhillon 16y ago
  Okay. I substitute "Honest Achmed" with "N-word Jim's Southern Signed Certificates". This shouldn't be racist at all, (edit: or if it is racist, it shouldn't matter) since there's a point. edit: There's a reason why it's Achmed, and not "Honest Matthew" or "Honest James".
  - dasil003 16y ago
    Where's the racial slur in Honest Achmed?

adulau 16y ago

For the curious, the procedure for applying to be included as a CA : https://wiki.mozilla.org/CA:How_to_apply https://wiki.mozilla.org/CA:How_to_apply and https://wiki.mozilla.org/CA:Recommended_Practices https://wiki.mozilla.org/CA:Recommended_Practices and the list of included certificate with their audit "certificate: http://www.mozilla.org/projects/security/certs/included/ http://www.mozilla.org/projects/security/certs/included/ or the pending list: http://www.mozilla.org/projects/security/certs/pending/ http://www.mozilla.org/projects/security/certs/pending/ As long as Mr. Honest Achmed is able to provide the appropriate audit certificate...

gcb 16y ago
which will be provided by Honest Achmed's Auto Insurance and Audits
- mtogo 16y ago
  It's turtles all the way down.

ra 16y ago

The problem is that we are forced to trust a particular CA because the company we are dealing with chose to buy their certificate from that particular CA. Whilst PKI provides solutions for this [1], they are not really practical in SSL. In any case, that's not how it works in the real world. In the real world, Achmed's uncles do trust Achmed, and might well trust him to validate the identity of a business partner. In essence, that's the logic behind PGP. What if SSL could be enhanced to allow PGP verification of counterparties? That way anyone could become the equivalent of a root CA, but your value would only be as good as your reputation / integrity. Trusted entities, like the governments, could vouch for the keys of their agencies - or other governments. Friends and Family could vouch for each others keys, businesses for their partners... etc etc. Unlike PKI, PGP would enable counterparties to establish their identiy by having many validating partners (paid and unpaid), as opposed to the one single root CA that is available. As well as bringing the source of trust closer to the relying party (really, I live in Australia, who the hell is Comodo anyway?), the network of trust that would result could be articulated in the browser in many different ways. eg: 25 of your friends and 600 businesses agree that this is the identity of Visa. Twenty years ago this wouldn't have worked. But today, we could use the root CA SSL system to bootstrap a network of trust that becomes independent of the old hierarchy. I hope all that makes sense. [1] eg: certificate revocation, or even the user removing the root CA from her own key store.

ciupicri 16y ago
Your proposition is indeed interesting, but let's not forget about the herd mentality. If a more technical savvy user will vouch for a certificate, tens of less technical users might follow and then you'll have the wrong impression about that certificate.
- T_S_ 16y ago
  You mean like Madoff?
  - ra 16y ago
    More like LinkedIn

hartror 16y ago

All of this talk reminds me of Rainbow's End by Vernor Vinge, a near future novel set in a future where augmented reality is ubiquitous. As part of the climax of the book there is talk of revoking a root certificate which would cause most of European commerce to grid to a halt. Vinge is a computer scientist so the whole thing reads very well from a hacker's perspective. Also it won the Hugo & Locus awards in 2007. Am a big fan. Wikipedia Entry: http://en.wikipedia.org/wiki/Rainbows_End http://en.wikipedia.org/wiki/Rainbows_End Buy it: http://www.amazon.com/Rainbows-End-Vernor-Vinge/dp/0812536363 http://www.amazon.com/Rainbows-End-Vernor-Vinge/dp/081253636...

deleted 16y ago

[deleted]

codeup 16y ago

TLDR for this HN thread: The problem posed by the mix of technical issues and ethnic prejudices in this "bug report" is apparently more complex than what the HN community can deal with. This is a low point for the quality of discussions on HN.

dschobel 16y ago
Well put. I cannot imagine what more evidence pg needs for collapsable threads or trigger-happy moderators than that thread.
skrebbel 16y ago
true that. which immediately shows how excellent the HN community still is, because i've seen far lower points on every other social site i know. good going, guys!
JoachimSchipper 16y ago
When I looked (2 hours after your comment), the top comments were pretty sensible. Looks like downvoting works.