4 ms·

The point about needing remediation channels is strong, but the rest of the argument seems overblown, considering (as the article points out).. it’s not like th

by ratg13 4y ago

The point about needing remediation channels is strong, but the rest of the argument seems overblown, considering (as the article points out).. it’s not like the private run CA industry is much better.

bayindirh 4y ago
This implicitly validates and approves the insufficient diligence in private CA industry. If government wants improvements, it needs to mandate it, not approve current bad state. Everybody is doing that, so we don't care doesn't work for security.
- Avamander 4y ago
  > If government wants improvements, it needs to mandate it, not approve current bad state. They should really start with participating in the CA/B forum workgroups, instead of trying to reinvent (and mangle) the wheel.
pannSun 4y ago
They're mandating who your privately-owned computer must trust. That is a severe overstepping of boundaries, and the concern shown is, if anything, too small.
- ratg13 4y ago
  You misunderstand. They are merely adding themselves to the defaults set by current manufacturers. End users are free to remove them. Microsoft, Mozilla and others already provide you with a list of who you’re going to trust by default. It would be more outrageous if the current CAs were some sort of gold standard, but the whole system is flawed.
  - pmontra 4y ago
    > End users are free to remove them. And browsers could create a "more secure" list of CAs, with governments CAs outside the list and a scary Accept the Risk page for everything outside the more secure list. Anyway, what happens when every government website use the new CAs and people will have to accept that because it's the only way to deal with government services? Every other site using those CAs will soon enjoy a free pass because of the Accept/Next/Next fatigue demonstrated by the last 30+ years of human computer interaction.
  - pannSun 4y ago
    > End users are free to remove them. Let's not pretend we don't know the power of defaults, or that we expect users to learn about and modify the obscure and technical innards of their browsers. Even expert users can be fooled, such as when the NSA bribed a company to default to a weak cipher [1]. > Microsoft, Mozilla and others already provide you with a list of who you’re going to trust by default. If I use Firefox, I choose to trust Mozilla. But now, whichever browser I choose, I am forced to trust its maker and the government and intelligence agencies of every EU member state. I can spend my limited time learning how to fix this, but is it legal to share my solution in a convenient form (such as a browser that by-default trusts CAs based on merit, not government order), or would that make me a browser vendor, and compel me to backdoor my software? This is, in effect, prohibiting cooperation to fight surveillance. > It would be more outrageous if the current CAs were some sort of gold standard, but the whole system is flawed. I don't see how the current system being flawed makes a government mandate to default-trust hypothetical known-untrustworthy CAs less bad. It is a red herring - is a system being "flawed" justification for government intrusion? And does this intrusion even attempt to fix those flaws?? [1] https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-million-for-a-back-door-into-rsa-encryption-according-to https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-mill...
jesboat 4y ago
The privately run industry is maybe a tiny bit better, but that's not the point. The point is that the only way browsers have to influence a CA or the industry is the threat to eventually distrust. If they can't threaten that to government-stamped CAs, then those CAs no longer even have an incentive to operate responsibly, and, as we know from the many, many incidents, they almost certainly won't.
- yakak 4y ago
  They could simply identify these like they did for EV certs. Whether you trust one of them more or less is then your choice, (certainly I wouldn't continue on a random e-shop with a country specific cert but I also don't like landing on a supposed government site that has a comodo cert and may want to sell me a green card) mediated by journalism and their ability to keep a better reputation than the lowest CA that still gets a lock. If I had to guess, half of the least trustworthy CAs in the one-store-fits-all keystore are also government affiliated ones and we don't even get anything to differentiate them from any regular commercial cert.

by ratg13 4y ago

bayindirh 4y ago

This implicitly validates and approves the insufficient diligence in private CA industry. If government wants improvements, it needs to mandate it, not approve current bad state. Everybody is doing that, so we don't care doesn't work for security.

Avamander 4y ago
> If government wants improvements, it needs to mandate it, not approve current bad state. They should really start with participating in the CA/B forum workgroups, instead of trying to reinvent (and mangle) the wheel.

pannSun 4y ago

They're mandating who your privately-owned computer must trust. That is a severe overstepping of boundaries, and the concern shown is, if anything, too small.

ratg13 4y ago
You misunderstand. They are merely adding themselves to the defaults set by current manufacturers. End users are free to remove them. Microsoft, Mozilla and others already provide you with a list of who you’re going to trust by default. It would be more outrageous if the current CAs were some sort of gold standard, but the whole system is flawed.
- pmontra 4y ago
  > End users are free to remove them. And browsers could create a "more secure" list of CAs, with governments CAs outside the list and a scary Accept the Risk page for everything outside the more secure list. Anyway, what happens when every government website use the new CAs and people will have to accept that because it's the only way to deal with government services? Every other site using those CAs will soon enjoy a free pass because of the Accept/Next/Next fatigue demonstrated by the last 30+ years of human computer interaction.
- pannSun 4y ago
  > End users are free to remove them. Let's not pretend we don't know the power of defaults, or that we expect users to learn about and modify the obscure and technical innards of their browsers. Even expert users can be fooled, such as when the NSA bribed a company to default to a weak cipher [1]. > Microsoft, Mozilla and others already provide you with a list of who you’re going to trust by default. If I use Firefox, I choose to trust Mozilla. But now, whichever browser I choose, I am forced to trust its maker and the government and intelligence agencies of every EU member state. I can spend my limited time learning how to fix this, but is it legal to share my solution in a convenient form (such as a browser that by-default trusts CAs based on merit, not government order), or would that make me a browser vendor, and compel me to backdoor my software? This is, in effect, prohibiting cooperation to fight surveillance. > It would be more outrageous if the current CAs were some sort of gold standard, but the whole system is flawed. I don't see how the current system being flawed makes a government mandate to default-trust hypothetical known-untrustworthy CAs less bad. It is a red herring - is a system being "flawed" justification for government intrusion? And does this intrusion even attempt to fix those flaws?? [1] https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-million-for-a-back-door-into-rsa-encryption-according-to https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-mill...

jesboat 4y ago

The privately run industry is maybe a tiny bit better, but that's not the point. The point is that the only way browsers have to influence a CA or the industry is the threat to eventually distrust. If they can't threaten that to government-stamped CAs, then those CAs no longer even have an incentive to operate responsibly, and, as we know from the many, many incidents, they almost certainly won't.

yakak 4y ago
They could simply identify these like they did for EV certs. Whether you trust one of them more or less is then your choice, (certainly I wouldn't continue on a random e-shop with a country specific cert but I also don't like landing on a supposed government site that has a comodo cert and may want to sell me a green card) mediated by journalism and their ability to keep a better reputation than the lowest CA that still gets a lock. If I had to guess, half of the least trustworthy CAs in the one-store-fits-all keystore are also government affiliated ones and we don't even get anything to differentiate them from any regular commercial cert.