3 ms·

At this point you can wonder if there is not an hidden agenda, because this push to reduce certificates is excessive regarding the commonality of the issue that

At this point you can wonder if there is not an hidden agenda, because this push to reduce certificates is excessive regarding the commonality of the issue that is supposed to be solved by that. I'm wondering if it is not a push by big tech lobbyists to push everyone to "cloud managed solutions". Because to be clear this makes life harder and more expensive for on prem solutions and device that might not be often online or freely connected to internet. Also, whatever service you will have in the world, you will be bound to be in frequent contacts with a limited number of actors even if only letsencrypt. And most of these actors, like letsencrypt also might be us based and found by whatever US regulation there would be an anytime.

xg15 2y ago
Yeah, had that thought as well at some point. It definitely feels like some constraint is slowly applied to the web, though I find the exact security properties somewhat nebulous. The one concrete requirement that seems to be pushed by this is that any host that expects to be accessed through a browser has to be connected to the internet at some point - and has to have an internet-registered domain name. (And at least the root of that name will be publicly visible in a CT log and will be processed and stored by who-knows-what) Though weirdly, it doesn't even matter to which particular service the host connects or if the domain name actually resolves to anything. But it does feel like some creeping "platformization" is going on: The requirements make it reliably a pain to run anything that's not connected to the internet, such as LAN-only websites or local web interfaces of IoT devices. I wonder if the end goal is some sort of "app-storization" of the web, where some entity has the power to ban a site globally, even if registrar, server and users are all in a different country and even if the site only exists internally on some LAN. But then again, I'm unsure if browsers couldn't effectively do that already today - so if they could, why all the effort? Taking off the conspiracy hat, maybe the tighter update requirements could be a push so that people finally develop some protocol how to securely update certificates on IoT devices. That would at least disprove the conspiracy theory.
tptacek 2y ago
I don't think the agenda is at all secret: it's a push to move the WebPKI to full automation, and to eliminate sites where administrators fetch certificate files and install them on servers. If you were an engineer and had to choose one over the other, you'd choose the former too: it's much more agile and it's less exposed to the large-scale distributed systems problem of revocation.
- taraindara 2y ago
  But nothing stops companies from doing this today, without forcing everyone to make the change also. You can refresh your cert every single day. the cert that gives me https on my home routers web interface doesn’t need that level of scrutiny.
  - tptacek 2y ago
    The browsers aren't going to let you not automate, because automated certificate issuance is safer and better for the ecosystem. Your convenience and the ease with which you can provision the interface to your router, which only you use, is not going to be a factor in that decision.
    - xg15 2y ago
      What does "safer and better for the ecosystem" even mean? Either there is a plausible threat model to defend against or there is not.
greatgib 2y ago
From another post, from Digicert, it looks like that my suspicion is confirmed: Prior to this proposal by Apple, Google promoted a 90-day maximum lifetime, but they voted in favor of Apple’s proposal almost immediately after the voting period began. https://news.ycombinator.com/item?id=43693900 https://news.ycombinator.com/item?id=43693900 To be noted that this doesn't just affect certificate generation, but also things like when you have a pool of subcertificates from a given certificate, that will all have to be regenerated and deployed as frequently in cascada, and also, like when you have server or clients or a specific device that validate specific certificates. Their only viable solution would be to accept widely any certificate from one of the big top level "trust" CAs...

xg15 2y ago

Yeah, had that thought as well at some point. It definitely feels like some constraint is slowly applied to the web, though I find the exact security properties somewhat nebulous. The one concrete requirement that seems to be pushed by this is that any host that expects to be accessed through a browser has to be connected to the internet at some point - and has to have an internet-registered domain name. (And at least the root of that name will be publicly visible in a CT log and will be processed and stored by who-knows-what) Though weirdly, it doesn't even matter to which particular service the host connects or if the domain name actually resolves to anything. But it does feel like some creeping "platformization" is going on: The requirements make it reliably a pain to run anything that's not connected to the internet, such as LAN-only websites or local web interfaces of IoT devices. I wonder if the end goal is some sort of "app-storization" of the web, where some entity has the power to ban a site globally, even if registrar, server and users are all in a different country and even if the site only exists internally on some LAN. But then again, I'm unsure if browsers couldn't effectively do that already today - so if they could, why all the effort? Taking off the conspiracy hat, maybe the tighter update requirements could be a push so that people finally develop some protocol how to securely update certificates on IoT devices. That would at least disprove the conspiracy theory.

tptacek 2y ago

I don't think the agenda is at all secret: it's a push to move the WebPKI to full automation, and to eliminate sites where administrators fetch certificate files and install them on servers. If you were an engineer and had to choose one over the other, you'd choose the former too: it's much more agile and it's less exposed to the large-scale distributed systems problem of revocation.

taraindara 2y ago
But nothing stops companies from doing this today, without forcing everyone to make the change also. You can refresh your cert every single day. the cert that gives me https on my home routers web interface doesn’t need that level of scrutiny.
- tptacek 2y ago
  The browsers aren't going to let you not automate, because automated certificate issuance is safer and better for the ecosystem. Your convenience and the ease with which you can provision the interface to your router, which only you use, is not going to be a factor in that decision.
  - xg15 2y ago
    What does "safer and better for the ecosystem" even mean? Either there is a plausible threat model to defend against or there is not.

greatgib 2y ago

From another post, from Digicert, it looks like that my suspicion is confirmed: Prior to this proposal by Apple, Google promoted a 90-day maximum lifetime, but they voted in favor of Apple’s proposal almost immediately after the voting period began. https://news.ycombinator.com/item?id=43693900 https://news.ycombinator.com/item?id=43693900 To be noted that this doesn't just affect certificate generation, but also things like when you have a pool of subcertificates from a given certificate, that will all have to be regenerated and deployed as frequently in cascada, and also, like when you have server or clients or a specific device that validate specific certificates. Their only viable solution would be to accept widely any certificate from one of the big top level "trust" CAs...