3 ms·
It's not that a major CA's root couldn't be revoked, but the situation would have to be extremely dire to warrant the negative impact. Plus, there's so little v
by justinschuh 15y ago
It's not that a major CA's root couldn't be revoked, but the situation would have to be extremely dire to warrant the negative impact. Plus, there's so little visibility into what the CAs are issuing that it's really hard to justify revocation--unless it's something public and obviously dangerous like the Diginotar situation. That's what I meant by "the system is just too big to fail."
(And to be clear, this is my opinion here, not me speaking for Google or Chrome.)
Edit: I just reread my original comment and I can see the confusion. I should have made it clear that I was talking about the response to this particular situation (issuing an intermediary for DLP). Basically, the CAs have no good reason to come clean, the abuse is hard to detect, and revocation is pretty hard to justify. So, it feels to me like the threat is hollow.
- tptacek 15y agoI think we agree more than we disagree, but I'm not fatalistic about browser CA roots; I think there are basic tactical things they can do today without breaking thousands of sites. I agree with the world view you have, though: of the 3 most important organizations that control CA policy (I'm guessing that's Mozilla, Apple, and Microsoft), you have 2 companies for whom CA policy is small-ball that they're just not going to fight hard over, and the third is easily pushed around. So, calling it like I see it: Mozilla isn't standing up for anything here, so much as they're getting rolled by abusive companies.
- justinschuh 15y agoI didn't think we were disagreeing on anything substantive, unless I'm misreading. Mozilla's letter strikes me as somewhat hollow posturing, and Apple and Microsoft don't really seem interested in doing anything.