4 ms·

How is it more secure? With certificate transparency, there has been almost no invalid certificates found, and anyone who produces one is immediately struck of

How is it more secure? With certificate transparency, there has been almost no invalid certificates found, and anyone who produces one is immediately struck off. I can't really imagine how web of trust would let me (for example) securely connect to hellbunny.com, a website I have no direct connection to,.and isn't that famous.

bombolo 4y ago
Why are root CA authorities holding on to private keys and sending them around? https://www.techtarget.com/searchsecurity/news/252436120/23000-Symantec-certificates-revoked-following-leak-of-private-keys https://www.techtarget.com/searchsecurity/news/252436120/230... The "trusted" party sometimes fails spectacularly it seems. > hellbunny.com, a website I have no direct connection to,.and isn't that famous. And what do you know about that certificate? That some root CA signed it. Do they follow a proper process? I don't care about random websites. For those letsencrypt is fine. But for banking or paying taxes I want some more checks done. And they aren't provided.
- tialaramex 4y ago
  > Why are root CA authorities holding on to private keys and sending them around? They aren't. In the story you link Trustico are a reseller. Once Trustico revealed that they had these keys which they shouldn't have, all the certificates were invalidated because they're worthless, the issuing CA - DigiCert - did exactly what we want them to do. If the corner store near me sells cans of Coke which they have poisoned, that's not a problem with Coca-Cola, it's problem with that local store. The local cops should get involved, and yes as happened here, the company whose product reputation they harmed should be angry about that and cut ties to them, no more Coke branded fridge if the store owners somehow stay in business (and indeed in my hypothetical if they avoid jail).
- tialaramex 4y ago
  > And what do you know about that certificate? That some root CA signed it. Do they follow a proper process? The purpose of m.d.s.policy, the discussion group where the decision to distrust Trustcor was made, is to oversee these root CAs. As part of that, we require them to use at least one of the Ten Blessed Methods (there aren't actually currently ten of them) to decide whether a subscriber is entitled to certificates for particular DNS names. You can read in the CAB BRs https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/ what the currently allowed Blessed Methods are in section 3.2.2.4 Validation of Domain Authorization or Control -- each method is numbered e.g. 3.2.2.4.19 is the most often used Let's Encrypt (ACME standard) web site authentication. You can also read in the CA's own documentation how they claim to implement one or more of the Blessed Methods, for example Let's Encrypt offer 3.2.2.4.19 and explain that, but they don't offer say 3.2.2.14 which is sending out emails with a magic random number in them to a domain contact's email address.

bombolo 4y ago

Why are root CA authorities holding on to private keys and sending them around? https://www.techtarget.com/searchsecurity/news/252436120/23000-Symantec-certificates-revoked-following-leak-of-private-keys https://www.techtarget.com/searchsecurity/news/252436120/230... The "trusted" party sometimes fails spectacularly it seems. > hellbunny.com, a website I have no direct connection to,.and isn't that famous. And what do you know about that certificate? That some root CA signed it. Do they follow a proper process? I don't care about random websites. For those letsencrypt is fine. But for banking or paying taxes I want some more checks done. And they aren't provided.

tialaramex 4y ago
> Why are root CA authorities holding on to private keys and sending them around? They aren't. In the story you link Trustico are a reseller. Once Trustico revealed that they had these keys which they shouldn't have, all the certificates were invalidated because they're worthless, the issuing CA - DigiCert - did exactly what we want them to do. If the corner store near me sells cans of Coke which they have poisoned, that's not a problem with Coca-Cola, it's problem with that local store. The local cops should get involved, and yes as happened here, the company whose product reputation they harmed should be angry about that and cut ties to them, no more Coke branded fridge if the store owners somehow stay in business (and indeed in my hypothetical if they avoid jail).
tialaramex 4y ago
> And what do you know about that certificate? That some root CA signed it. Do they follow a proper process? The purpose of m.d.s.policy, the discussion group where the decision to distrust Trustcor was made, is to oversee these root CAs. As part of that, we require them to use at least one of the Ten Blessed Methods (there aren't actually currently ten of them) to decide whether a subscriber is entitled to certificates for particular DNS names. You can read in the CAB BRs https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/ what the currently allowed Blessed Methods are in section 3.2.2.4 Validation of Domain Authorization or Control -- each method is numbered e.g. 3.2.2.4.19 is the most often used Let's Encrypt (ACME standard) web site authentication. You can also read in the CA's own documentation how they claim to implement one or more of the Blessed Methods, for example Let's Encrypt offer 3.2.2.4.19 and explain that, but they don't offer say 3.2.2.14 which is sending out emails with a magic random number in them to a domain contact's email address.