Hacker News Reader

Google cares that governments aren't man-in-the-middling their web browser when talking to their online services.

That's how the DigiNotar breach was publicly disclosed. The browser/CA CAB forum knew about it and had been hiding it for weeks until an actual Chrome user posted a message in the Gmail support forum: https://www.google.com/support/forum/p/gmail/thread?tid=2da6...

> The browser/CA CAB forum knew about it and had been hiding it for weeks

That's really criminal.

.. which perhaps calls for collectively mette punishment.

DigiNotar knew about and hid the attack. I don't believe there is any evidence that the CA/Browser Forum knew about the attack until it was made public.

Right. Well the attacks (and emergency revocations) go back at least to March with Comodo. Vasco/Diginotar had auditors and outside security consultants in June. Maybe not CAB Forum per se, but I'm not so sure I believe that no one was notified of anything. There are likely some serious contractual disclosure obligations there, perhaps even criminal WRT the Dutch government.

> If it remains hard to do, she'll stick to the default config, which is what she does already.

The problem with the CA system is that the default config is already unsafe, let alone robust, as evidenced by major browsers hastily releasing new versions to be able to revoke trust in a single CA. Jane McNewbie goes to sleep every night without a worry on her mind while the Comodos and Diginotars of this world make mistake after mistake. Is that really so much better?

> So, the main change wrt the current PKI system is that by default, her browser would probably check a certificate validity against a couple of top authorities, rather than a single one. I guess it would make getting a certificate a couple of times more complicated, hence a couple of times more expensive (if the process of trust propagation is fully automated, then I'm no safer than with a single CA signature).

You guess? Have you actually looked at Convergence?

I think he advantage of this is that websites aren't tied to a single CA, so you can drop a root certificate without breaking them all, regardless of who actually makes the decision.

In two words, 'trust agility' as they say in the website.