3 ms·
CAs are money printing machines. If they cannot even track the state of their delegated trust, then why should they be trusted themselves?! Trust is their core
by paulryanrogers 2y ago
CAs are money printing machines. If they cannot even track the state of their delegated trust, then why should they be trusted themselves?! Trust is their core value proposition, the only reason they exist!
- phasmantistes 2y agoFor what it's worth, the person you're replying to is the founder and executive director of Let's Encrypt, the non-profit free and open CA which decidedly isn't a money-printing machine.
- schoen 2y agoThe person you're replying to (Josh Aas) is the head of the largest CA in the world, which has never charged anyone for a certificate and has never made a profit. That CA, at least, isn't a money-printing machine!
- paulryanrogers 2y agoGood point. Though being a non-profit doesn't remove the fact that the value proposition of CAs is trust. Perhaps there is some compromise like they just have to submit all issuances certs to a 3rd party, and maintain the last few months worth of issuances.
- schoen 2y agoPart of that compromise is already in effect: https://certificate.transparency.dev/ https://certificate.transparency.dev/
- dontdoxxme 2y agoWhy don’t CT logs include revocations? Seems like that could provide transparency into this without the need for another system (OCSP)
- schoen 2y agoDownloading the CT log is an enormous amount of data, so it addresses a rather different case from the "is this certificate valid right now (because I'm thinking of accepting it)?" question.