So in effect, if one of these CA's issues a counterfeit certificate that is being used for MITM attacks, and a browser maker removes the CA from their trusted list, the browser maker could suffer legal consequences?
Is that correct?
Is that correct?
Long story short, this isn't about asking browsers to ignore flawed procedures or lacking security. Incompetence is always a factor and this law won't allow for more incompetence than we're already used to from private CA's.
This is about preventing browsers from distrusting government-controlled CA's issuing certificates used to MITM traffic. EU's trying to do what Khazakhstan (IIRC, could be one of the other -stans) did a few years ago).
I'd like to say that in a democracy the use of such powers are limited, but every so often I find myself disappointed by news that such powers are directed at protesters in the UK, and my news about the US leans towards "gosh don't these police cars look suspiciously more capable than actual military vehicles".
For stuff like this, my main concern is that it creates an easy way for hostile agents (someone else's security agencies rather than our own) to break things that ought not to be breakable.
But, given that most people (including most criminals) are clueless about digital security, this kind of thing may genuinely be useful for breaking into otherwise-secret chat forums.
I can't balance these competing concerns. I really hope the people on our side ("security is good") are getting taken seriously by the agencies; but I don't have any reason to think that hope is anything more than wishful thinking.
The governments of the world are essentially our enemies. Encryption technology needs to start threat modeling with governments in mind. Cryptography must be so ubiquitous and undefeatable that it's impossible for any government to do anything about it short of nuking its own citizens.
Heck, I’d do away with governments existing and advocate anarchism, except for the messy reality of human nature.
Sure, but that doesn't imply that we should create new tyrannical powers out of whole cloth, just so the state can have them. The more that power remains distributed, allowing the population freedom and self-determination, the better.
The problem with governments is they dominate the entire earth. They force their social contract on us and we're forced to accept it just because we happened to be born somewhere. We can't just reject their power and rules: leaving is expensive, difficult or impossible and the only thing we can do is escape to another imperfect government.
Sure, in a sense the dual authoritarian powers of government/capital are always going to be looking for ways to push into our lives, turn voluntary two party relationships into chaperoned/extractive three party ones, etc. But as individuals that wish to remain individuals living in a distributed society, our job is to push back.
Don't forget that DANE requires DNSSEC, which your DNS service provider must support (and switching DNS provider is not 'relatively easy').
Another problem with DNSSEC is that there are some people (and with 'some people' I mean tptacek) who are ferociously against it.
Also, TLSA records require maintenance. If you forget to update them you will break things. Had to rotate your keys unexpectedly? Well now you have to wait for DNS propagation and explain your boss that some of your customers may get scary warning messages for a few hours when they try to reach you, and there will be nothing you can do about it.