3 ms·

Next blogpost: Alternative certificate authority

by 0x073 5y ago

merlinscholz 5y ago
That post is in the works for months now, I have a huge list of dumb ideas to go through
- southerntofu 5y ago
  I'd be very interested if your post contains an OpenPGP-CA review. I'm more familiar with "traditional" ways and that project looked very interesting to me.
tptacek 5y ago
What do you want to know? It's quite easy to set up a new CA, and all mainstream browsers have (albeit crappy) user interface for adding them.
- merlinscholz 5y ago
  The root ca installation is the boring part, installing a local Let’s Encrypt instance is much more fun
st_goliath 5y ago
FYI: There is CAcert.org[1][2], which attempted to establish a community run authority (long before let's encrypt was a thing) and IIRC Mozilla was at least discussing including their root cert. I remember some years back at Chaos Congress in Hamburg, a friend of mine who was very enthusiastic about CAcert physically met with a few CAcert people to show them his passport and get his certificate signed. [1] http://www.cacert.org/ http://www.cacert.org/ [2] https://en.wikipedia.org/wiki/CAcert.org https://en.wikipedia.org/wiki/CAcert.org
- hansel_der 5y ago
  imo if cacert had bee included in any major browser, it would have dumpstered the ca-industry in a week. the verification process with passports and physical meetings meant it had better security and crowdsourcing made it effectively free of charge; billions of revenue just gone.
  - acdha 5y ago
    You'd have needed at least Mozilla and Microsoft to be on-board. The failure mode for a CA is that someone cannot use your site and that's not something you can ignore for serious usage — it took Let's Encrypt years and backing by influential organizations to get established. I like CA Cert, got verified with my passport at Usenix, etc. but still ended up not using it anywhere except some personal servers because life is way too short to walk people through installing a CA, especially with the knowledge that you're training them to be susceptible to attacks.

Next blogpost: Alternative certificate authority

by 0x073 5y ago

Next blogpost: Alternative certificate authority

merlinscholz 5y ago

That post is in the works for months now, I have a huge list of dumb ideas to go through

southerntofu 5y ago
I'd be very interested if your post contains an OpenPGP-CA review. I'm more familiar with "traditional" ways and that project looked very interesting to me.

tptacek 5y ago

What do you want to know? It's quite easy to set up a new CA, and all mainstream browsers have (albeit crappy) user interface for adding them.

merlinscholz 5y ago
The root ca installation is the boring part, installing a local Let’s Encrypt instance is much more fun

st_goliath 5y ago

FYI: There is CAcert.org[1][2], which attempted to establish a community run authority (long before let's encrypt was a thing) and IIRC Mozilla was at least discussing including their root cert. I remember some years back at Chaos Congress in Hamburg, a friend of mine who was very enthusiastic about CAcert physically met with a few CAcert people to show them his passport and get his certificate signed. [1] http://www.cacert.org/ http://www.cacert.org/ [2] https://en.wikipedia.org/wiki/CAcert.org https://en.wikipedia.org/wiki/CAcert.org

hansel_der 5y ago
imo if cacert had bee included in any major browser, it would have dumpstered the ca-industry in a week. the verification process with passports and physical meetings meant it had better security and crowdsourcing made it effectively free of charge; billions of revenue just gone.
- acdha 5y ago
  You'd have needed at least Mozilla and Microsoft to be on-board. The failure mode for a CA is that someone cannot use your site and that's not something you can ignore for serious usage — it took Let's Encrypt years and backing by influential organizations to get established. I like CA Cert, got verified with my passport at Usenix, etc. but still ended up not using it anywhere except some personal servers because life is way too short to walk people through installing a CA, especially with the knowledge that you're training them to be susceptible to attacks.