3 ms·

Why can't Let's Encrypt push-back on this for their users' sake? What is Google going to do? distrust LE certs?

agwa 8mo ago
Google Chrome (along with Mozilla, and eventually the other root stores) distrusted Symantec, despite being the largest CA at the time and frequently called "too big to fail".
- notepad0x90 8mo ago
  Given how ubiquitous LE is, I think people will switch browsers first. non-chrome browsers based on chrome are plenty as well, they can choose to trust LE despite Chrome's choices. Plus, they had a good reason with Symantec, a good reason to distrust them that is. This is just them flexing, there is no real reason to distrust LE, non-web-pki does not reduce security.
  - nightpool 8mo ago
    GP gave a very good reason that non-web-PKI reduces security, you just refused to accept it. Anybody who has read any CA forum threads over the past two years is familiar with how big of a policy hole mixed-use-certificates are when dealing with revocation timelines and misissuance.
    - account42 8mo ago
      There was no good reason given only a "trust me bro".
    - sam_lowry_ 8mo ago
      > non-web-PKI reduces security How exactly?
    - notepad0x90 8mo ago
      "it's complicated" is not the same as "it's insecure". Google feels like removing this complexity improves security for web-pki. Improving security is not the same as saying something is insecure. Raising security for web-pki is not the same as caliming non-web-pki usage is insecure or is degrading security expectations of web-pki users. It's just google railroading things because they can. You can improve security by also letting Google decide and control everything, they have the capability and manpower. But we don't want that either.
- account42 8mo ago
  Half the web didn't rely on Symantec for free certificates. They do rely on LE.
  - direwolf20 8mo ago
    If LE is distrusted, we all stop using TLS and go back to letting the NSA read everything. LE is the only reason HTTPS is now ubiquitous.
    - b112 8mo ago
      Isn't that a really, really juicy target though?
      - Ayesh 8mo ago
        LetsEncrypt doesn't see your private key when you obtain the certificate. So no, it's not _really_ a juicy target.
        account42 8mo ago
        On the other hand, who's gong to notice a LE issued cert that they did not request in the certificate transparency logs?
        cpach 8mo ago
        The ones who monitor their domains in the CT log. (Mom-and-pop-stores probably won’t. Other orgs might.)
    - notepad0x90 8mo ago
      Why not just stop using Chrome and start using any of the Chrome-based alternatives in instead?
      - direwolf20 8mo ago
throw_a_grenade 8mo ago
If they wanted, they absolutely can distrust LE. The trick is to distrust only certificates issued after specific date (technically: with „NotBefore” field after specific point in time), so the certs already issued continue to work for the duration of their validity (until „NotAfter”). That way they can phase out even the biggest CAs. Moreover, they have infrastructure in place and playbook well rehearsed on other CAs already. TL;DR yes, tis a credible threat.
- kedihacker 8mo ago
  They can do this with certificate transparency other wise CA can sign whatever date they want. But if they collude with CT that can issue rouge certificates for targeted attacks.
  - throw_a_grenade 8mo ago
    Yes, that's all right, there's already a requirement that they submit to one Google CT log and one non-Google CT log. They thought about it already. The playbook I mentioned they've been rehearsing contains specific threat against backdating certs, they say they'll distrust immediately if they detect, and they have means of detecting backdating on significant scale (esp. for LE, where they submit 100% issued certs, not just the subset that is intended for consumption with Chrome).
- Ajedi32 8mo ago
  Interestingly though, doesn't this threat become less credible the shorter certificate lifetimes get? Back in the day they could just do this and server admins would figure out how to switch to a new CA the next time they got around to renewing their certificate. Now though that's all automated, so killing a CA will likely nuke a bunch of sites.
  - throw_a_grenade 8mo ago
    This is good point. I think it would still be discounted in favour of suggesting another CAs that users can switch to, but you're right, the promise was that cert management would be hands off, and changing CAs is not hands off in any ACME client that I know of. Best Google could do would be to shift the blame to LE/ISRG, because it was ISRG that promised this automation.

agwa 8mo ago

Google Chrome (along with Mozilla, and eventually the other root stores) distrusted Symantec, despite being the largest CA at the time and frequently called "too big to fail".

notepad0x90 8mo ago
Given how ubiquitous LE is, I think people will switch browsers first. non-chrome browsers based on chrome are plenty as well, they can choose to trust LE despite Chrome's choices. Plus, they had a good reason with Symantec, a good reason to distrust them that is. This is just them flexing, there is no real reason to distrust LE, non-web-pki does not reduce security.
- nightpool 8mo ago
  GP gave a very good reason that non-web-PKI reduces security, you just refused to accept it. Anybody who has read any CA forum threads over the past two years is familiar with how big of a policy hole mixed-use-certificates are when dealing with revocation timelines and misissuance.
  - account42 8mo ago
    There was no good reason given only a "trust me bro".
  - sam_lowry_ 8mo ago
    > non-web-PKI reduces security How exactly?
  - notepad0x90 8mo ago
    "it's complicated" is not the same as "it's insecure". Google feels like removing this complexity improves security for web-pki. Improving security is not the same as saying something is insecure. Raising security for web-pki is not the same as caliming non-web-pki usage is insecure or is degrading security expectations of web-pki users. It's just google railroading things because they can. You can improve security by also letting Google decide and control everything, they have the capability and manpower. But we don't want that either.
account42 8mo ago
Half the web didn't rely on Symantec for free certificates. They do rely on LE.
- direwolf20 8mo ago
  If LE is distrusted, we all stop using TLS and go back to letting the NSA read everything. LE is the only reason HTTPS is now ubiquitous.
  - b112 8mo ago
    Isn't that a really, really juicy target though?
    - Ayesh 8mo ago
      LetsEncrypt doesn't see your private key when you obtain the certificate. So no, it's not _really_ a juicy target.
      - account42 8mo ago
        On the other hand, who's gong to notice a LE issued cert that they did not request in the certificate transparency logs?
        cpach 8mo ago
        The ones who monitor their domains in the CT log. (Mom-and-pop-stores probably won’t. Other orgs might.)
  - notepad0x90 8mo ago
    Why not just stop using Chrome and start using any of the Chrome-based alternatives in instead?
    - direwolf20 8mo ago

throw_a_grenade 8mo ago

If they wanted, they absolutely can distrust LE. The trick is to distrust only certificates issued after specific date (technically: with „NotBefore” field after specific point in time), so the certs already issued continue to work for the duration of their validity (until „NotAfter”). That way they can phase out even the biggest CAs. Moreover, they have infrastructure in place and playbook well rehearsed on other CAs already. TL;DR yes, tis a credible threat.

kedihacker 8mo ago
They can do this with certificate transparency other wise CA can sign whatever date they want. But if they collude with CT that can issue rouge certificates for targeted attacks.
- throw_a_grenade 8mo ago
  Yes, that's all right, there's already a requirement that they submit to one Google CT log and one non-Google CT log. They thought about it already. The playbook I mentioned they've been rehearsing contains specific threat against backdating certs, they say they'll distrust immediately if they detect, and they have means of detecting backdating on significant scale (esp. for LE, where they submit 100% issued certs, not just the subset that is intended for consumption with Chrome).
Ajedi32 8mo ago
Interestingly though, doesn't this threat become less credible the shorter certificate lifetimes get? Back in the day they could just do this and server admins would figure out how to switch to a new CA the next time they got around to renewing their certificate. Now though that's all automated, so killing a CA will likely nuke a bunch of sites.
- throw_a_grenade 8mo ago
  This is good point. I think it would still be discounted in favour of suggesting another CAs that users can switch to, but you're right, the promise was that cert management would be hands off, and changing CAs is not hands off in any ACME client that I know of. Best Google could do would be to shift the blame to LE/ISRG, because it was ISRG that promised this automation.