5 ms·

Would Mozilla (or any browser vendor) really remove them if they had 20% of the cert market? That will be an interesting test.

Skalman 15y ago
Hopefully the bigger CAs have better policies, and would inform vendors immediately. (I'm sure Diginotar had policies too, just that they probably weren't followed) But if a CA was compromised and they didn't know the how many certificates they had issued, surely they'd have to block the root cert, if not permanently?
- dmethvin 15y ago
  If you shut down one of the big boys like VeriSign you might as well shut down the Internet as far as someone like Amazon is concerned, since VeriSign issued their SSL. The entire ecommerce world would be at Challenger-level rationalization, in essence, "How do you know it will burn through the O-rings? Since we don't have enough evidence we can't shut it down!" I think it's much more likely that lacking any evidence of widespread active fraud, ecommerce would simply go on as usual but with more trip wires to detect fraud and perhaps delayed payments to reduce the chance that money from fraudulent transactions would make its way to the bad guys. And of course, they'd switch out all the certs ASAP. It's a chance merchants and banks would be willing to take, I suspect, and sort out damages in court afterwards.
  - Skalman 15y ago
    True. We really need a plan B, to plan what to do in such a scenario, but there doesn't seem to be enough of an incentive to improve the system yet.
    - marshray 15y ago
      Amazon gets a new cert with a different provider and revokes the old one. Those people are pretty talented operationally. This should not be a difficult thing to do.
      - mseebach 15y ago
        Given the catastrophic nature of being without a cert and the relative low cost of those, it's not hard to believe that they maintain a backup certificate, ready to switch in at a moments notice.
        marshray 15y ago
        Probably lots of sites will after this week. IMHO it's getting a little out of hand how much concern is being given to the gov.nl private PKI system and the few hundred other certs Diginotar issued where the website admins have to swap a file or two. The big deal is the security of the whole freaking internet resting on top of this tiny little web app and server in .nl and the unknown number of actual users in .ir getting MitMd and likely horribly persecuted.
  - nknight 15y ago
    One thing to remember is that VeriSign was originally an RSA spinoff, and helped define the role and requirements of today's certificate authorities. Granted a lot has happened since then, including the CA unit's sale to Symantec, but I'd be very, very surprised if VeriSign/Symantec handled a breach in the totally incompetent manner DigiNotar has. Long-term, it's becoming less of an issue anyway. The market is always spreading out, and the market share of the "big boys" will continue to shrink. More CAs means more possible breaches, of course, but it also reduces the wider cost of shutting down any single CA. (Not that I don't agree that the CA system as currently constituted has issues, I just don't think VeriSign is the big problem.)
idiot900 15y ago
I should hope they would! What good is a security measure when you know that it has been breached, you know that there are significant exploits in the wild, and you don't know the extent of the damage? Not removing them would destroy user trust in the security of the browser in general.
jmtame 15y ago
There are 3 major CAs: VeriSign (47% share), GoDaddy (23%), Comodo (15%). So would they remove VeriSign or GoDaddy? I really doubt that, those CAs hold way too much of the market. I guess the question is: would those big CAs make the same mistake? Relevant quote: "This is a nightmare scenario. You have to trust the companies selling these certificates and if we can't, then all bets are off." —Mikko Hyppönen, head of research at F-Secure
- burgerbrain 15y ago
  Not only will they make mistakes, they already have.
  - haberman 15y ago
    Citation needed.
    - burgerbrain 15y ago
      Comodo had huge issues very recently, and VeriSign's issues go back about as far as they do (providing intercept services to governments. That wasn't even an 'accident'.) Godaddy? I don't know much about what they do but I wager you wouldn't have to dig deep. Edit: I'm not the only one saying this: http://www.youtube.com/watch?v=Z7Wl2FW2TcA http://www.youtube.com/watch?v=Z7Wl2FW2TcA Modding me down will not restore the trust.
      - haberman 15y ago
        You're getting modded down because you are not providing any specifics. "Comodo had huge issues" is not a citation; it doesn't contain enough information for people to independently evaluate your claims. Another commenter provided an actual link (and did not get modded down).
        burgerbrain 15y ago
        This is common knowledge, unless you've been under a rock. It's not my job to google things for other people. http://www.google.com/search?q=comodo+incident http://www.google.com/search?q=comodo+incident http://www.hnsearch.com/search#request/submissions&q=comodo&start=0 http://www.hnsearch.com/search#request/submissions&q=com...
InclinedPlane 15y ago
If a CA becomes compromised they should be removed from every browser ASAP, otherwise the system is meaningless.
- marshray 15y ago
  Tell it to Mozilla, Google, Microsoft, Apple, and all the other members of the CAB forum. http://www.cabforum.org/ http://www.cabforum.org/ Point and laugh at them until they look up from counting their money long enough to realize that the entire value proposition of their business model is at risk. Maybe they're ready for some change now?
  - asadotzler 15y ago
    "Point and laugh at [Mozilla] until they look up from counting their money long enough to realize that the entire value proposition of [Mozilla's] business model is at risk" ????

Skalman 15y ago

Hopefully the bigger CAs have better policies, and would inform vendors immediately. (I'm sure Diginotar had policies too, just that they probably weren't followed) But if a CA was compromised and they didn't know the how many certificates they had issued, surely they'd have to block the root cert, if not permanently?

dmethvin 15y ago
If you shut down one of the big boys like VeriSign you might as well shut down the Internet as far as someone like Amazon is concerned, since VeriSign issued their SSL. The entire ecommerce world would be at Challenger-level rationalization, in essence, "How do you know it will burn through the O-rings? Since we don't have enough evidence we can't shut it down!" I think it's much more likely that lacking any evidence of widespread active fraud, ecommerce would simply go on as usual but with more trip wires to detect fraud and perhaps delayed payments to reduce the chance that money from fraudulent transactions would make its way to the bad guys. And of course, they'd switch out all the certs ASAP. It's a chance merchants and banks would be willing to take, I suspect, and sort out damages in court afterwards.
- Skalman 15y ago
  True. We really need a plan B, to plan what to do in such a scenario, but there doesn't seem to be enough of an incentive to improve the system yet.
  - marshray 15y ago
    Amazon gets a new cert with a different provider and revokes the old one. Those people are pretty talented operationally. This should not be a difficult thing to do.
    - mseebach 15y ago
      Given the catastrophic nature of being without a cert and the relative low cost of those, it's not hard to believe that they maintain a backup certificate, ready to switch in at a moments notice.
      - marshray 15y ago
        Probably lots of sites will after this week. IMHO it's getting a little out of hand how much concern is being given to the gov.nl private PKI system and the few hundred other certs Diginotar issued where the website admins have to swap a file or two. The big deal is the security of the whole freaking internet resting on top of this tiny little web app and server in .nl and the unknown number of actual users in .ir getting MitMd and likely horribly persecuted.
- nknight 15y ago
  One thing to remember is that VeriSign was originally an RSA spinoff, and helped define the role and requirements of today's certificate authorities. Granted a lot has happened since then, including the CA unit's sale to Symantec, but I'd be very, very surprised if VeriSign/Symantec handled a breach in the totally incompetent manner DigiNotar has. Long-term, it's becoming less of an issue anyway. The market is always spreading out, and the market share of the "big boys" will continue to shrink. More CAs means more possible breaches, of course, but it also reduces the wider cost of shutting down any single CA. (Not that I don't agree that the CA system as currently constituted has issues, I just don't think VeriSign is the big problem.)

idiot900 15y ago

I should hope they would! What good is a security measure when you know that it has been breached, you know that there are significant exploits in the wild, and you don't know the extent of the damage? Not removing them would destroy user trust in the security of the browser in general.

jmtame 15y ago

There are 3 major CAs: VeriSign (47% share), GoDaddy (23%), Comodo (15%). So would they remove VeriSign or GoDaddy? I really doubt that, those CAs hold way too much of the market. I guess the question is: would those big CAs make the same mistake? Relevant quote: "This is a nightmare scenario. You have to trust the companies selling these certificates and if we can't, then all bets are off." —Mikko Hyppönen, head of research at F-Secure

burgerbrain 15y ago
Not only will they make mistakes, they already have.
- haberman 15y ago
  Citation needed.
  - burgerbrain 15y ago
    Comodo had huge issues very recently, and VeriSign's issues go back about as far as they do (providing intercept services to governments. That wasn't even an 'accident'.) Godaddy? I don't know much about what they do but I wager you wouldn't have to dig deep. Edit: I'm not the only one saying this: http://www.youtube.com/watch?v=Z7Wl2FW2TcA http://www.youtube.com/watch?v=Z7Wl2FW2TcA Modding me down will not restore the trust.
    - haberman 15y ago
      You're getting modded down because you are not providing any specifics. "Comodo had huge issues" is not a citation; it doesn't contain enough information for people to independently evaluate your claims. Another commenter provided an actual link (and did not get modded down).
      - burgerbrain 15y ago
        This is common knowledge, unless you've been under a rock. It's not my job to google things for other people. http://www.google.com/search?q=comodo+incident http://www.google.com/search?q=comodo+incident http://www.hnsearch.com/search#request/submissions&q=comodo&start=0 http://www.hnsearch.com/search#request/submissions&q=com...

InclinedPlane 15y ago

If a CA becomes compromised they should be removed from every browser ASAP, otherwise the system is meaningless.

marshray 15y ago
Tell it to Mozilla, Google, Microsoft, Apple, and all the other members of the CAB forum. http://www.cabforum.org/ http://www.cabforum.org/ Point and laugh at them until they look up from counting their money long enough to realize that the entire value proposition of their business model is at risk. Maybe they're ready for some change now?
- asadotzler 15y ago
  "Point and laugh at [Mozilla] until they look up from counting their money long enough to realize that the entire value proposition of [Mozilla's] business model is at risk" ????