Hacker News Reader

Comment by dantiberian | Hacker News Reader

This is a big step, but my first thought is "How many times will this be pushed back before it is implemented?". I get the impression that the browser vendors have to drag most CA's kicking and screaming into programs that offer greater security.

View on HN

Indeed, Comodo view it as positive to make "optional", defeating the purpose:

https://blog.instantssl.com/ssl/certificate-transparency-cla...

To be fair, that was in May 2016 where it was optional, AFAIK today was the first major announcement that CT will be required for all certs in Chrome (although obviously it was always coming). That blog post reads as much about Comodo throwing shade on Symantec as it does about clarifying CT.

More importantly, how secure will the monitor be, and how flexible the monitor system will be? Will Chrome be hard-coded to only trust Google monitors, forcing the whole trust chain to be held at ransom by a single private entity?

If it would, use Chromium and monitors you trust.

If Google's own monitors would miss critical events that others didn't, they'd be blamed and shamed.

If they didn't share knowledge of critical events which other monitors for whatever reason couldn't detect, they'd be attacked in media.

The most plausible outcome is that all major monitors will share data openly. There's no point with a public certificate transparency scheme if they don't.

As for the security (ability to report on critical events) of individual monitors, you have to read up on the guarantees that the CT logs can provide.

Browsers will make their own policies regarding which log servers they'll trust, similar to the CA system. Google's policy for log server operators is documented here[1] and is fairly strict - a number of third-party log servers have been removed in the past due to non-compliance. Chrome's policy for what they consider a "CT qualified" certificate can be found here[2] and asks for SCTs from at least one Google and non-Google-operated log server.

[1]: https://www.chromium.org/Home/chromium-security/certificate-...

[2]: https://a77db9aa-a-7b23c8ea-s-sites.googlegroups.com/a/chrom...

That's the real trick in a trust-based system. We have multiple CAs to prevent single points of failure or control, but now that there are so many CAs, and well-known powerful actors seeking to exploit CAs, there's a need for more oversight and enforcement, which leads back to a central authority and a single point of failure and control.

Chromium has a CT policy in place, and the Google CT team and the Chromium team who make inclusion decisions are separate, so currently this is working well. There are a number of non-google logs currently included.

The issue with mandating CT isn't the CAs. CAs are generally supportive of CT. The big push back comes from corporations and the fact that CT logging also logs any of their internally issued SSL Certificates if it was issued by a public Certificate Authority.

So any internal domain and domain hierarchy is exposed to the general public who queries for the organization's domain in the CT log.

Reply on news.ycombinator.com