3 ms·

I was the product manager with responsibility for root certificates in the Netscape 4.51 browser. It's crazy to see someone factor it 25 years later. Just to r

I was the product manager with responsibility for root certificates in the Netscape 4.51 browser. It's crazy to see someone factor it 25 years later. Just to reply to some people in the comments. Yes, we knew export grade encryption was weak - that was the point - that the NSA could decrypt it - and the govt. required us to do it anyway. FWIW - we had the goal of expanding the list of root authorities in the 4.5x release - and this might have been the first release to monetize the root slots because Netscape was under severe pressure to generate revenue. (Also - Verisign hated that we were expanding competition and tried to convince us to implement a program that would re-restrict the list to a set of "responsible" companies aka Verisign and one or two others. We declined.)

jetbalsa 24d ago
Its a shame that Microsoft ate Netscape's lunch so early on. I still use Firefox and have fond memories of Netscape (v7) when growing up.
- cyanydeez 24d ago
  Its a shame public internet is npt viewed as a public utility
  - AnthonyMouse 24d ago
    How do you imagine that would work for something like this? Suppose you live in South America, register a domain from a registry in Canada and then have users accessing it from Ukraine. Are we going to give every local government a global root certificate? Have a single one in California or Texas that every other country is somehow forced to use? Or make it so people in Europe can't access sites in Asia and vice versa? The existing system is more than the usual amount of messed up but that seems like one of the things that could actually make it worse.
    - cyanydeez 24d ago
      same way every public utility works. It's great until a capitalist buys your government and forces you to sell it back to them while they rent seek.
    - otabdeveloper4 23d ago
      You don't need a "root certificate". Just publish a public key in your DNS TXT records. ACME is just that anyways but with extra (pointless) steps. The whole SSL certificate grift is just a way to extort money out of nothing.
      - mdemare 23d ago
        Ok, but now you need to trust DNSSEC.
        necovek 23d ago
        The point GP was making is that DNS-record based ACME mechanism for verification of ownership implies trust in the domain name owner (or really, anyone who can edit records in the domain zone), making the issuance of a certificate actually superfluous. DNSSEC is probably not even used, though I never checked. Eg. as a domain owner, you will put a cryptographic hash into your DNS zone so a CA can validate you have control over it, and then issue a different cryptographic hash derived from their private key, and browser will use their public key to validate this cryptographic hash (TLS cert) is valid. So we could simply push public key into a DNS zone, and browsers could use it to decrypt the traffic encrypted by the private key from the server hosted under that DNS name: no CAs needed, similar to SSH except the DNS-ownership-implied-trust component. "Extended validation" certificates involved a lot more (in theory, checking true ownership, business address, physical presence, etc), but nobody really cares about these, and with the push to automated renewal and 45-day expiration dates by 2028, it's going to make even less sense. Edit: I realize now that you may be referring to the fact that MITM DNS server can inject a different public key in there and thus DNSSEC is required — you are absolutely right, and this is a good and important point.
- necovek 23d ago
  IIRC, Netscape 4.* series was the last in the proprietary line of Netscape Navigators (though 4.* had a broader name like "Communicator" or something, since it included more than just the browser — but "3.0 Gold" was the one I remember most fondly as my first true good browser). After that, open source efforts to rebuild the entire browser and mail client took years as XUL and Gecko were being built as very generic reusable components, opening up the space for competition to spring up. On top of that, Microsoft leveraged the Windows moat, including IE 3.0 and later 4.0 as the basis of Windows "97" (95 something-something) and 98, along with ActiveX push. By the time legal systems caught up with the practice of bundling a browser into a dominant OS, Netscape and Mozilla were toast. Everything from there on was an uphill battle, and when KHTML was turned into WebKit by Apple, and adopted by Google for Chrome, there was also an open source engine (or two) supported by infinite money. That's at least how I remember it, but you are welcome to fact-check me on any of those since this is now 20-30 years ago.
CGMthrowaway 24d ago
Did you have any personal interaction with NSA or their proxies?
- tptacek 24d ago
  The point of export cryptography is not needing any personal interactions.
- hnmullany 23d ago
  No that was above my pay grade. They met with the engineering leads directly.
mcpherrinm 24d ago
Fascinating! My involvement in this space starts much later, so it’s always interesting to hear from folks involved at the time. The rumours about monetizing the root program is one I’ve heard repeated but never anything concrete. These days with the CA/Browser forum, CCADB, and openly run root programs from Mozilla, Chrome and others, this is all much better documented than what went on in the early days, so I definitely have some strong historical interest in what came before.
- pseudohadamard 23d ago
  At the time there were two root programs, Microsoft's and Netscape's. To get into them, for Microsoft you had to go through a painful third-party audit process, SAS 70 from memory, for Netscape you turned up in Mountain View with a suitcase full of cash (this was the informal description of the process). It cost about the same for both programs, again from memory $0.5M each.
  - hnmullany 23d ago
    For 4.51, it was $100k per cert slot. We were just trying to cover the cost of the engineering team.

jetbalsa 24d ago

Its a shame that Microsoft ate Netscape's lunch so early on. I still use Firefox and have fond memories of Netscape (v7) when growing up.

cyanydeez 24d ago
Its a shame public internet is npt viewed as a public utility
- AnthonyMouse 24d ago
  How do you imagine that would work for something like this? Suppose you live in South America, register a domain from a registry in Canada and then have users accessing it from Ukraine. Are we going to give every local government a global root certificate? Have a single one in California or Texas that every other country is somehow forced to use? Or make it so people in Europe can't access sites in Asia and vice versa? The existing system is more than the usual amount of messed up but that seems like one of the things that could actually make it worse.
  - cyanydeez 24d ago
    same way every public utility works. It's great until a capitalist buys your government and forces you to sell it back to them while they rent seek.
  - otabdeveloper4 23d ago
    You don't need a "root certificate". Just publish a public key in your DNS TXT records. ACME is just that anyways but with extra (pointless) steps. The whole SSL certificate grift is just a way to extort money out of nothing.
    - mdemare 23d ago
      Ok, but now you need to trust DNSSEC.
      - necovek 23d ago
        The point GP was making is that DNS-record based ACME mechanism for verification of ownership implies trust in the domain name owner (or really, anyone who can edit records in the domain zone), making the issuance of a certificate actually superfluous. DNSSEC is probably not even used, though I never checked. Eg. as a domain owner, you will put a cryptographic hash into your DNS zone so a CA can validate you have control over it, and then issue a different cryptographic hash derived from their private key, and browser will use their public key to validate this cryptographic hash (TLS cert) is valid. So we could simply push public key into a DNS zone, and browsers could use it to decrypt the traffic encrypted by the private key from the server hosted under that DNS name: no CAs needed, similar to SSH except the DNS-ownership-implied-trust component. "Extended validation" certificates involved a lot more (in theory, checking true ownership, business address, physical presence, etc), but nobody really cares about these, and with the push to automated renewal and 45-day expiration dates by 2028, it's going to make even less sense. Edit: I realize now that you may be referring to the fact that MITM DNS server can inject a different public key in there and thus DNSSEC is required — you are absolutely right, and this is a good and important point.
necovek 23d ago
IIRC, Netscape 4.* series was the last in the proprietary line of Netscape Navigators (though 4.* had a broader name like "Communicator" or something, since it included more than just the browser — but "3.0 Gold" was the one I remember most fondly as my first true good browser). After that, open source efforts to rebuild the entire browser and mail client took years as XUL and Gecko were being built as very generic reusable components, opening up the space for competition to spring up. On top of that, Microsoft leveraged the Windows moat, including IE 3.0 and later 4.0 as the basis of Windows "97" (95 something-something) and 98, along with ActiveX push. By the time legal systems caught up with the practice of bundling a browser into a dominant OS, Netscape and Mozilla were toast. Everything from there on was an uphill battle, and when KHTML was turned into WebKit by Apple, and adopted by Google for Chrome, there was also an open source engine (or two) supported by infinite money. That's at least how I remember it, but you are welcome to fact-check me on any of those since this is now 20-30 years ago.

CGMthrowaway 24d ago

Did you have any personal interaction with NSA or their proxies?

tptacek 24d ago
The point of export cryptography is not needing any personal interactions.
hnmullany 23d ago
No that was above my pay grade. They met with the engineering leads directly.

mcpherrinm 24d ago

Fascinating! My involvement in this space starts much later, so it’s always interesting to hear from folks involved at the time. The rumours about monetizing the root program is one I’ve heard repeated but never anything concrete. These days with the CA/Browser forum, CCADB, and openly run root programs from Mozilla, Chrome and others, this is all much better documented than what went on in the early days, so I definitely have some strong historical interest in what came before.

pseudohadamard 23d ago
At the time there were two root programs, Microsoft's and Netscape's. To get into them, for Microsoft you had to go through a painful third-party audit process, SAS 70 from memory, for Netscape you turned up in Mountain View with a suitcase full of cash (this was the informal description of the process). It cost about the same for both programs, again from memory $0.5M each.
- hnmullany 23d ago
  For 4.51, it was $100k per cert slot. We were just trying to cover the cost of the engineering team.