3 ms·

The problem is that CAs aren't really part of the cryptosystem. They hold the roots of trust but charge for there services and are for-profit. Without any compe

The problem is that CAs aren't really part of the cryptosystem. They hold the roots of trust but charge for there services and are for-profit. Without any competition we would have a terrible monopoly. I agree that there are too many CAs. But the ideal number is also significantly more than 1. ...well unless you include zero. If we can replace this with something better that would be much more desirable.

woodruffw 4y ago
How so? The cryptosystem in question is WebPKI. CAs form the roots of trust in WebPKI, as you mentioned. > They hold the roots of trust but charge for there services and are for-profit. Without any competition we would have a terrible monopoly. This hasn't been true for years! Let's Encrypt provides free certificates to anyone with a domain. They issue millions of certs a day and secure a massive chunk of the web[1]. I think everybody is in broad agreement that the CA system is brittle, vulnerable to mismanagement, bad actors, etc. But "something better" is very hard to identify and implement. Churchill's saying about the "worse system except for all the others"[1] applies equally well here, IMO. [1]: https://blogs.fcdo.gov.uk/petermillett/2014/03/05/the-worst-form-of-government/ https://blogs.fcdo.gov.uk/petermillett/2014/03/05/the-worst-... [1]: https://www.linuxfoundation.org/resources/case-studies/lets-encrypt https://www.linuxfoundation.org/resources/case-studies/lets-...
- luckylion 4y ago
  > This hasn't been true for years! Let's Encrypt provides free certificates to anyone with a domain. Because they are the competition.
  - woodruffw 4y ago
    The point being that the monopoly's back has been broken. We're no longer in a situation where there needs to be >100 CAs for market competition purposes; there's now a free, universally available, public service.
    - lmm 4y ago
      Is LE really universally available? I'm not aware of them making any public commitment to serve unpopular websites (thinking of e.g. KiwiFarms), and they used to check an opaque Google blacklist before issuing certificates.
      - woodruffw 4y ago
        They list no stipulations about prohibited certificate uses[1]. Their restrictions on domain uses seem to be mostly tied to legal requirements (not issuing for sanctioned countries, for example). It's all also pretty transparent, from what I can tell[2][3]. Certainly more so than a normal CA. [1]: https://letsencrypt.org/documents/isrg-cp-v3.3/#1.4.2-prohibited-certificate-uses https://letsencrypt.org/documents/isrg-cp-v3.3/#1.4.2-prohib... [2]: https://letsdebug.net/ https://letsdebug.net/ [3]: https://github.com/letsdebug/letsdebug https://github.com/letsdebug/letsdebug

woodruffw 4y ago

How so? The cryptosystem in question is WebPKI. CAs form the roots of trust in WebPKI, as you mentioned. > They hold the roots of trust but charge for there services and are for-profit. Without any competition we would have a terrible monopoly. This hasn't been true for years! Let's Encrypt provides free certificates to anyone with a domain. They issue millions of certs a day and secure a massive chunk of the web[1]. I think everybody is in broad agreement that the CA system is brittle, vulnerable to mismanagement, bad actors, etc. But "something better" is very hard to identify and implement. Churchill's saying about the "worse system except for all the others"[1] applies equally well here, IMO. [1]: https://blogs.fcdo.gov.uk/petermillett/2014/03/05/the-worst-form-of-government/ https://blogs.fcdo.gov.uk/petermillett/2014/03/05/the-worst-... [1]: https://www.linuxfoundation.org/resources/case-studies/lets-encrypt https://www.linuxfoundation.org/resources/case-studies/lets-...

luckylion 4y ago
> This hasn't been true for years! Let's Encrypt provides free certificates to anyone with a domain. Because they are the competition.
- woodruffw 4y ago
  The point being that the monopoly's back has been broken. We're no longer in a situation where there needs to be >100 CAs for market competition purposes; there's now a free, universally available, public service.
  - lmm 4y ago
    Is LE really universally available? I'm not aware of them making any public commitment to serve unpopular websites (thinking of e.g. KiwiFarms), and they used to check an opaque Google blacklist before issuing certificates.
    - woodruffw 4y ago
      They list no stipulations about prohibited certificate uses[1]. Their restrictions on domain uses seem to be mostly tied to legal requirements (not issuing for sanctioned countries, for example). It's all also pretty transparent, from what I can tell[2][3]. Certainly more so than a normal CA. [1]: https://letsencrypt.org/documents/isrg-cp-v3.3/#1.4.2-prohibited-certificate-uses https://letsencrypt.org/documents/isrg-cp-v3.3/#1.4.2-prohib... [2]: https://letsdebug.net/ https://letsdebug.net/ [3]: https://github.com/letsdebug/letsdebug https://github.com/letsdebug/letsdebug