4 ms·
The alleged reasoning is to stop malware. A signed certificate must come from an authority willing to put their own reputation on the line, but Google does not
by Zikes 13y ago
The alleged reasoning is to stop malware. A signed certificate must come from an authority willing to put their own reputation on the line, but Google does not need to be the only such authority.
- jfoster 13y agoSo the extension being installed on some malicious site would have a popup talking about security certificates and such, and asking the user whether they want to proceed? You and I might think twice, but most users just click "Yes". Signed certificates would not be adequate to protect the average user.
- Zikes 13y agoThe idea is that the browser would only accept signed certificates, and only those certificates which the signing authority has not revoked. So long as the signing authority is in a trusted list, the user would see no Yes/No option at all. It would simply install, or be rejected outright with an explanation of why. It would be like limiting web browsing to HTTPS only, except you would not be given the option to click through for unsigned certificates.
- jfoster 13y agoSo then Google could still revoke the certificates of any ad blocking software.
- haberman 13y agoGreat! I am the "Definitely Not A Malware Author" certificate authority and I have signed this "Definitely Not Malware" extension.
- sirsar 13y agoNot quite. The DNAMA would quickly lose hard-won reputation once DNM was shown to be malware. Google not being the only CA doesn't mean everyone gets to be a CA.
- haberman 13y ago> Not quite. The DNAMA would quickly lose hard-won reputation once DNM was shown to be malware. No problem. I am a completely different "Definitely Not A Malware Author 2" certificate authority and I have signed this "Definitely Not Malware" extension. > Google not being the only CA doesn't mean everyone gets to be a CA. Oh. In that case who gets to decide who gets to be a CA?
- JSadowski 13y agoWho decides who gets to be a CA for SSL certs? Similar process. Somehow my browser doesn't recognize a CA that would allow any random person to pretend to be Facebook.
- haberman 13y agoThe web browser authors/distributors decide what root CAs will be included in their browsers. So in this case concerning Chrome, Google decides. Which means Google is still in charge, ultimately. Which means that this digital signature scheme hasn't actually accomplished anything.
- Zikes 13y agoGoogle controls the entire browser, meaning they are in absolute control, ultimately. They could inject code into your banking web sites, they could block all the porn, whatever they want. The idea isn't that the certificates would wrest control away from Google, it's that they wouldn't be able to use "omg the malwares" as a shield for their intentions. If there's a root CA that's handing out certs for malware extensions then sure, pull the plug, but if the root CA is handing out certs for ad blockers and Google pulls the plug then it'll be plain as day what they're doing. Heck, all the browsers nowadays use extensions of some sort, maybe they could form a consortium for extension certifications so no one company would be in complete control. You could bet Mozilla would keep that sort of behavior in check, at least.
- 13y ago