3 ms·

While I suppose I trust Google to be a well-behaved CA more than many of the current CAs, I still don't like the idea of a single company utterly dominating the

While I suppose I trust Google to be a well-behaved CA more than many of the current CAs, I still don't like the idea of a single company utterly dominating the CA business no matter how well-intentioned they may be.

smacktoward 12y ago
Yeah, this is my concern too. The closer we get to being able to have a Google-only Internet experience (Google DNS, SPDY vs HTTP, Chrome as the browser, etc.) the more nervous I get. It's just a lot of power to concentrate in one place.
- adestefan 12y ago
  Don't forget Google as the ISP (Fiber).
  - michaelt 12y ago
    Don't forget the search engine, the webmail provider, the ad network, the analytics service, maps, sign in with google, youtube, docs, javascript library CDN, fonts, Android, social network, translation system, and blogging network.
    - smacktoward 12y ago
      "But other than THAT, how was the play, Mrs. Lincoln?"
macinjosh 12y ago
100% agree. Google has way too much power over the Internet and web already. Just try blocking google.com in your hosts file and see how far you get online.
quesera 12y ago
I agree, but: the existing CAs are some of the most sketchy companies I see running Internet infrastructure. Domain registrars give them some competition (and are sometimes same same). Tim writes: > The only other companies with comparable scale and reach at the moment are, in my opinion, Facebook and (maybe) Microsoft. I think it would make perfect sense for either of them to get into the biz as well. I'd imagine that Facebook is poised (as poised as Facebook gets) to enter the personal certificate/identity provision space, but It's hard to imagine them doing server certs. Micro-who?
- alex_duf 12y ago
  I would NOT trust any US company holding a root certificate. Just because of the patriot act. So no thank you. Giving that power to very little actors is a very bad idea and security should not rely on few actors. We should just be able to revoke certificates more easily.
  - quesera 12y ago
    I don't disagree. The US has some work to do if they care about trust. But easy revocation is not the answer. It scales tremendously poorly. There might not be an answer.

smacktoward 12y ago

Yeah, this is my concern too. The closer we get to being able to have a Google-only Internet experience (Google DNS, SPDY vs HTTP, Chrome as the browser, etc.) the more nervous I get. It's just a lot of power to concentrate in one place.

adestefan 12y ago
Don't forget Google as the ISP (Fiber).
- michaelt 12y ago
  Don't forget the search engine, the webmail provider, the ad network, the analytics service, maps, sign in with google, youtube, docs, javascript library CDN, fonts, Android, social network, translation system, and blogging network.
  - smacktoward 12y ago
    "But other than THAT, how was the play, Mrs. Lincoln?"

macinjosh 12y ago

100% agree. Google has way too much power over the Internet and web already. Just try blocking google.com in your hosts file and see how far you get online.

quesera 12y ago

I agree, but: the existing CAs are some of the most sketchy companies I see running Internet infrastructure. Domain registrars give them some competition (and are sometimes same same). Tim writes: > The only other companies with comparable scale and reach at the moment are, in my opinion, Facebook and (maybe) Microsoft. I think it would make perfect sense for either of them to get into the biz as well. I'd imagine that Facebook is poised (as poised as Facebook gets) to enter the personal certificate/identity provision space, but It's hard to imagine them doing server certs. Micro-who?

alex_duf 12y ago
I would NOT trust any US company holding a root certificate. Just because of the patriot act. So no thank you. Giving that power to very little actors is a very bad idea and security should not rely on few actors. We should just be able to revoke certificates more easily.
- quesera 12y ago
  I don't disagree. The US has some work to do if they care about trust. But easy revocation is not the answer. It scales tremendously poorly. There might not be an answer.