4 ms·
There are tons of edge cases here. Let's assume, and this is not unlikely, that your favourite three-letter agency in is possession of a handful of trusted CA
by xorcist 12y ago
There are tons of edge cases here.
Let's assume, and this is not unlikely, that your favourite three-letter agency in is possession of a handful of trusted CA keys, acquired with extralegal methods.
What happens when there is leak? This may be the result of a whistleblower, or some mistake somewhere, which leads us to have a stronger confidence that these keys are out. Do we still blacklist? Only the intermediary, or all the way up to the CA?
I think we've seen from the past years that both root and intermediaries can follow every rule in the book and still get owned by intelligence agencies. We simply cannot pretend this is unacceptable for doing business.
- exo762 12y agoI think that this is a perfect case where tech giants can increase "cost of doing business" for NSA. NSA is having it too easyfucking over citizens. Now let them try fucking over businesses and still get away with it. I think that this is a great reason to have zero-tolerance policy to CAs fuckups.
- kijin 12y agoMy thoughts exactly. The world is not a chess board. The rest of the pieces don't just stay where they are and watch passively while you make a move. It may take a while for the full effects to be felt, but sooner or later the board as a whole will find a new equilibrium. Browser vendors publicly announcing a zero-tolerance policy would effectively be a warning to the governments of the world: "Do not fuck with our PKI, or else." This will have far-reaching consequences even before any CA officially gets banned.
- rakoo 12y agoWe bust the certs all the way to the CA. If it's been acquired through "extralegal" methods (an interesting word to not say "illegal", even though we all know it is), no matter who did it, security is compromised.