4 ms·

I'm not sure how to put this nicely, but I'll try my best: The normal people, who account for 99% of the end users of DigiCert's customers, are not going to dis

by jchw 2y ago

I'm not sure how to put this nicely, but I'll try my best: The normal people, who account for 99% of the end users of DigiCert's customers, are not going to disable updates on their web browser or their OS to "take a stand" against this decision. (And corporate users can't do this anyways, since it's not in their hands, and keeping things out of date is not a reasonable option for an organization that has security standards.) Most of them won't know what is going on here, and if they hear about it, probably won't care or know what to do about it. That's the Web PKI infrastructure working as intended, because it would be infeasible for billions of people to properly understand the gravity of all of these decisions. In order to ensure that TLS connections are at least minimally safe, it's pretty much necessary for things to work this way. I'm not arguing that it's good that a relatively small number of entities (mainly Google, Microsoft and Mozilla) decide which CAs are trustworthy, but that's all the more reason that it's important for all of this Web PKI work to happen completely in the open, so that the few who can spare the time and effort to scrutinize what is going on can help the rest of us have a safer Internet. We don't have a better solution. That's also why DigiCert issuing legal threats because they don't like how one of these issue reports makes them look is a serious problem that can't be tolerated.

LegionMammal978 2y ago
> The normal people, who account for 99% of the end users of DigiCert's customers, are not going to disable updates on their web browser or their OS to "take a stand" against this decision. I'd imagine that they wouldn't do it to "take a stand" so much as "avoid the risk of getting their stuff broken in the short term" in this scenario, regardless of whichever party loses the blame game. See: the recent WordPress drama, which has turned customers away from both parties involved.
- jchw 2y ago
  As I understand it, the way certificate authorities are removed from the trust store is progressive: they will announce a date after which new certificates from a given CA will no longer be trusted. I think this can be made even more progressive, by limiting the validity period of new certificates that will be trusted. DigiCert will have little recourse other than to let their customers know, and/or start providing certificates issued by another CA that follows the web PKI procedures and remains trusted. (They can still do that, of course, it's just that their own certificates issued by them directly won't be trusted anymore.) On the flip side, for user impact, it will play out like this: Some bank or other important entity could possibly, for whatever reason, continue using a (presumably expired? unless DigiCert continues issuing anyways; note that most likely, they will not.) DigiCert certificate after the cut off date, which will lead to users receiving errors. Some of them will have HSTS setup, which will lead to an emergency situation where they have to issue a new certificate ASAP, as it will basically halt their business until they do. For places where there is no HSTS, users may be instructed to simply bypass the certificate warning temporarily, and support lines will be absolutely swamped until they actually fix the problem. The WordPress situation is quite different. You don't have to use WordPress. Users don't even know what the Web PKI is to find an alternative to it, not that there is one or will be one.
- snailmailstare 2y ago
  Sure some users would keep the CA active out of fear, while everyone paying digicert would also begin to move out of fear.. What portion of the strange sort of sites that couldn't figure out how to get off but could figure out how to renew would bother with paying for a different error message?
cortesoft 2y ago
> mainly Google, Microsoft and Mozilla They don't have free rein to do whatever they want. If they chose to remove them, they are going to have to be ready to defend themselves in court.
- jchw 2y ago
  Why exactly do you think certificate authorities have a legal right to appear in trust stores?
  - saurik 2y ago
    Is that really the claim, though? If someone chooses to punish DigiCert for compliance with the TRO then DigiCert might have grounds to file for declarative relief from the court, as the court could very well decide to help protect DigiCert from external consequences of their demand.
    - nickf 2y ago
      Perhaps, but only in the case that the delayed revocations were scoped to those certificates covered by the TRO, and not over 1000x more from subscribers who had nothing to do with the company who filed the TRO.
    - jchw 2y ago
      Well personally, I think that'd be a terrible position for them to take. Honoring the TRO is, as far as I can tell, not the issue that is being raised.
  - cortesoft 2y ago
    This case literally involves the courts getting involved in what should appear in trust stores. DigiCert was ordered by the courts to not revoke certificates via a TRO. If the browsers removed DigiCert, DigiCert could certainly sue based on the harm to their business. They could argue that the browser vendors were inconsistent with the application of their rules. They could argue that the browser vendors were unfairly competing by kicking them out. Not saying they would win all these, but they would certainly fight it - the alternative would be the end of DigiCert, they aren't going to go down without a fight in whatever venue they can find.
userbinator 2y ago
The normal people, who account for 99% of the end users of DigiCert's customers, are not going to disable updates on their web browser or their OS to "take a stand" against this decision. ...unless they notice the breakage, and you tell them to do so to stop it.
- jchw 2y ago
  Ignoring the policy reasons that this won't happen, not all devices can be downgraded, so by then it's too late anyway. Best you can do is bypass a non-HSTS certificate warning. That all assumes DigiCert continues issuing certificates they know won't be trusted. I assume most likely what will actually happen is they have to start selling certificates from another CA, but failing that they're probably just going to stop issuing certificates before the cutoff.

by jchw 2y ago

LegionMammal978 2y ago

> The normal people, who account for 99% of the end users of DigiCert's customers, are not going to disable updates on their web browser or their OS to "take a stand" against this decision. I'd imagine that they wouldn't do it to "take a stand" so much as "avoid the risk of getting their stuff broken in the short term" in this scenario, regardless of whichever party loses the blame game. See: the recent WordPress drama, which has turned customers away from both parties involved.

jchw 2y ago
As I understand it, the way certificate authorities are removed from the trust store is progressive: they will announce a date after which new certificates from a given CA will no longer be trusted. I think this can be made even more progressive, by limiting the validity period of new certificates that will be trusted. DigiCert will have little recourse other than to let their customers know, and/or start providing certificates issued by another CA that follows the web PKI procedures and remains trusted. (They can still do that, of course, it's just that their own certificates issued by them directly won't be trusted anymore.) On the flip side, for user impact, it will play out like this: Some bank or other important entity could possibly, for whatever reason, continue using a (presumably expired? unless DigiCert continues issuing anyways; note that most likely, they will not.) DigiCert certificate after the cut off date, which will lead to users receiving errors. Some of them will have HSTS setup, which will lead to an emergency situation where they have to issue a new certificate ASAP, as it will basically halt their business until they do. For places where there is no HSTS, users may be instructed to simply bypass the certificate warning temporarily, and support lines will be absolutely swamped until they actually fix the problem. The WordPress situation is quite different. You don't have to use WordPress. Users don't even know what the Web PKI is to find an alternative to it, not that there is one or will be one.
snailmailstare 2y ago
Sure some users would keep the CA active out of fear, while everyone paying digicert would also begin to move out of fear.. What portion of the strange sort of sites that couldn't figure out how to get off but could figure out how to renew would bother with paying for a different error message?

cortesoft 2y ago

> mainly Google, Microsoft and Mozilla They don't have free rein to do whatever they want. If they chose to remove them, they are going to have to be ready to defend themselves in court.

jchw 2y ago
Why exactly do you think certificate authorities have a legal right to appear in trust stores?
- saurik 2y ago
  Is that really the claim, though? If someone chooses to punish DigiCert for compliance with the TRO then DigiCert might have grounds to file for declarative relief from the court, as the court could very well decide to help protect DigiCert from external consequences of their demand.
  - nickf 2y ago
    Perhaps, but only in the case that the delayed revocations were scoped to those certificates covered by the TRO, and not over 1000x more from subscribers who had nothing to do with the company who filed the TRO.
  - jchw 2y ago
    Well personally, I think that'd be a terrible position for them to take. Honoring the TRO is, as far as I can tell, not the issue that is being raised.
- cortesoft 2y ago
  This case literally involves the courts getting involved in what should appear in trust stores. DigiCert was ordered by the courts to not revoke certificates via a TRO. If the browsers removed DigiCert, DigiCert could certainly sue based on the harm to their business. They could argue that the browser vendors were inconsistent with the application of their rules. They could argue that the browser vendors were unfairly competing by kicking them out. Not saying they would win all these, but they would certainly fight it - the alternative would be the end of DigiCert, they aren't going to go down without a fight in whatever venue they can find.

userbinator 2y ago

The normal people, who account for 99% of the end users of DigiCert's customers, are not going to disable updates on their web browser or their OS to "take a stand" against this decision. ...unless they notice the breakage, and you tell them to do so to stop it.

jchw 2y ago
Ignoring the policy reasons that this won't happen, not all devices can be downgraded, so by then it's too late anyway. Best you can do is bypass a non-HSTS certificate warning. That all assumes DigiCert continues issuing certificates they know won't be trusted. I assume most likely what will actually happen is they have to start selling certificates from another CA, but failing that they're probably just going to stop issuing certificates before the cutoff.