4 ms·

I've said it many times, but nobody seems concerned: Certificate authorities are being used as tools of censorship by oppressive regimes. Until a central-autho

by maxk42 6y ago

I've said it many times, but nobody seems concerned: Certificate authorities are being used as tools of censorship by oppressive regimes. Until a central-authority-free alternative exists, the move to HTTPS is bad for a free world.

shadowgovt 6y ago
Is it better for a free world to have the traffic be unencrypted? Feels like one head of the hydra is control of the cert-trust network, but another head is traffic-sniffing and monitoring one's online activity, yeah?
- maxk42 6y ago
  Please do not bring a straw man argument to the table. I clearly said " Until a central-authority-free alternative exists". Such alternatives are readily available and already used to secure e.g. ssh connections, but are not without drawbacks. One alternative that might be less likely to suffer from the same weaknesses as a certifcate-free model is a distributed certificate authority that relies on a ledger like DNS.
  - Spivak 6y ago
    Those are the same thing. The CA system is a distributed X.500 database. It's the most distributed database in the world since the entries that comprise it are the certs themselves. Moving the infrastructure to DNS wouldn't change the nature of the system, just which entities are at the root. Hell, the CA system right now delegates authority to domain registrars and the DNS system.
bpye 6y ago
I understand that centralised CAs are not ideal, but how is HTTPS by default any worse than plaintext?
- maxk42 6y ago
  Simple: The oppressive regime in question can deny you a certificate thereby censoring you. Some also require you to use a particular certificate, thereby creating the illusion of security while being able to intercept, interdict, or MiTM information any time they like or continually. Here's an article that touches upon it superficially from 2010, and also notes that private companies are already selling these capabilities to authoritarian governments: https://arstechnica.com/information-technology/2010/03/govts-certificate-authorities-conspire-to-spy-on-ssl-users/ https://arstechnica.com/information-technology/2010/03/govts...

by maxk42 6y ago

shadowgovt 6y ago

Is it better for a free world to have the traffic be unencrypted? Feels like one head of the hydra is control of the cert-trust network, but another head is traffic-sniffing and monitoring one's online activity, yeah?

maxk42 6y ago
Please do not bring a straw man argument to the table. I clearly said " Until a central-authority-free alternative exists". Such alternatives are readily available and already used to secure e.g. ssh connections, but are not without drawbacks. One alternative that might be less likely to suffer from the same weaknesses as a certifcate-free model is a distributed certificate authority that relies on a ledger like DNS.
- Spivak 6y ago
  Those are the same thing. The CA system is a distributed X.500 database. It's the most distributed database in the world since the entries that comprise it are the certs themselves. Moving the infrastructure to DNS wouldn't change the nature of the system, just which entities are at the root. Hell, the CA system right now delegates authority to domain registrars and the DNS system.

bpye 6y ago

I understand that centralised CAs are not ideal, but how is HTTPS by default any worse than plaintext?

maxk42 6y ago
Simple: The oppressive regime in question can deny you a certificate thereby censoring you. Some also require you to use a particular certificate, thereby creating the illusion of security while being able to intercept, interdict, or MiTM information any time they like or continually. Here's an article that touches upon it superficially from 2010, and also notes that private companies are already selling these capabilities to authoritarian governments: https://arstechnica.com/information-technology/2010/03/govts-certificate-authorities-conspire-to-spy-on-ssl-users/ https://arstechnica.com/information-technology/2010/03/govts...