2 ms·
You're right, it's not immediately obvious across the board. But in this very specific case, Mozilla is making an argument that the government standards are mea
by danShumway 5y ago
You're right, it's not immediately obvious across the board. But in this very specific case, Mozilla is making an argument that the government standards are meaningfully less secure than their own.
Involving a government doesn't magically make things better 100% of the time, the actual tangible proposal still has to be better than what is happening in the market. Is that the case here? We don't need to have an abstract argument about whether governments or private corporations are always better; look at the specifics of this proposal and see if they're good for browser security.
We have a lot of data that suggests that EV certificates do not provide meaningful security because the "green lock" doesn't actually guarantee what consumers think it does. Independent of what you think about governments overall, is it good to have a new standard that ignores that research in favor of having yet another kind of special certificate that is displayed to users as more trustworthy?
In this specific case, Camerfirma is still considered by the EU government to be a trustworthy certificate provider even though all major browsers have blocked the company for repeated mistakes/policy violations. Independent of whether or not you trust the government overall, is a standard that would require browsers to trust Camerfirma a good idea?
I don't think we should immediately assume any government involvement in the market is a bad idea, but there's also real danger in saying, "well, in theory it might be preferable for this to be more democratic", and then never asking the followup question, "but in practice, is this specific proposal good?" Yes, you're 100% correct, it's not immediately obviously bad across the board for the government to control something. But when I go beyond what is immediately obvious to me, then I start seeing arguments from Mozilla and other security researchers that (in my mind) make a lot of sense.