Hacker News Reader

Comment by walrus01 | Hacker News Reader

From the perspective of a person who thankfully no longer has to support any Windows based platforms:

"Symantec considered harmful"

full stop.

Let's not forget this: http://arstechnica.com/security/2015/10/still-fuming-over-ht...

Symantec should have suffered the CA "death penalty" and had its trust removed from the browsers that hold most of the global market share.

View on HN

What we need is for Microsoft, Apple, and Mozilla to settle on a plan to collectively eliminate negligent CAs. It seems like existing CAs would have to hand out valid certs to Hitler before they are removed from the trusted root store. We already have high standards for any new CAs to be added, why can't we have high standards for CAs to keep their trusted status?

We don't have to either do nothing or revoke the CA entirely. We could just only trust certificates with an issue date before a certain deadline. When the next DigiNotar or Comodo pops up just set a deadline of 3 or 6 months to revoke their status as a CA. No customers would be harmed by this, they have the rest of the lifetime of their cert or 6 months to move to a decent CA. This would be a clear stop to an untrustworthy CA without the negative ramifications for any party other than the CA itself. And 5 years or so after the deadline has past, all of their certs are invalid anyways and the CA can be completely removed. If the CA starts issuing bogus certs with a forged issue date, just remove them immediately and make sure that every CA knows that this is the process for removing a CA.

Maybe we wouldn't have CAs in the news every year if there were actual consequences for existing CAs.

It's ok to hand certs to Hitler.

It's not OK to let Hitler be an intermediate CA.

I don't see a good reason why handing out a certificate to Hitler would be grounds for having your root trust revoked.

Exactly, I don't get this argument at all. I think the way Google handled the Symantec issue was just fine, but we don't need to live in a world where CA's need precrime units to clear someone for a cert. I do Nazi issuing Hitler a cert as a problem, anne frankly I don't think anyone should care.

I was mostly just being hyperbolic but I meant valid certs for domains that our hypothetical Hitler did not own.

What if there were a middle ground between browsers trusting and rejecting a CA? What if there were a yellow "proceed with caution" warning on sites using certificates issued by CAs that have very occasionally behaved improperly?

If this gets implemented in a way that's clearly visible to the user, the effects on the CA are almost indistinguishable from the death sentence. The vast majority of customers would switch to some competitor that's not affected. Even a handful of saved customer support cases due to this warning is going to make up for the cost of switching. Most importantly, if users are confronted with warnings all the time, they become increasingly oblivious to them and might very well click through more important warnings down the line.

Given the propensity of normal end users to click "OK/Accept" through just about anything, I don't think this is a good idea, as another poster points out. There's a reason why it's a multi-step process/warning in Firefox or Chrome to accept a self-signed or invalid SSL certificate from an httpd. If it's a single click yellow warning banner it could do real harm to widespread use and trust of https.

Netscape used to have support for something similar. I think another idea would be an icon in the address bar.

I know about this incident. I don't think that would be a good idea in this case.

In my opinion the bar is set much too high for the "Root CA death penalty". There has really only ever been one case:

https://en.wikipedia.org/wiki/DigiNotar

Agreed. Comodo has fucked up so badly, they really should be on the list:

https://en.wikipedia.org/wiki/Comodo_Group#Controversies

Only one major case. There are other minor cases too, but mostly affecting less commonly used small CAs.

I would be interested to hear why.

Reply on news.ycombinator.com