Comment by tombrossman | Hacker News Reader

Comment by tombrossman | Hacker News Reader

Parent Full thread

They probably deserve it but the net effect would be to break many sites for many users. One step forward, two steps back.

What privacy-minded users need is a trusted list of root CA's and a (relatively) easy way to instruct their browsers to use only that list. For example, The Hong Kong Post Office is a CA installed in your browser and you can choose to delete or distrust it. Same thing for Turktrust, AOL, etc.

I imagine there are plenty of other CA's which could be distrusted but I don't know enough to make an informed decision and I don't want to start deleting them randomly and breaking my browsing experience. I'd love to see a list curated by a trusted organisation like the EFF or the Open Rights Group, which I could refer to when choosing which CA's to remove from my browser.

> They probably deserve it but the net effect would be to break many sites for many users. One step forward, two steps back.

This is the attitude that, I think, make these problems possible. There is a time when you should care about collateral damage - say, when deciding whether or not to install malicious crapware that steals from people and/or throws feces in their faces while they browse. But here, it's time to have balls. They should pull it.

Because right now, Comodo literally pulled off the Honest Achmed move[0] - they sold so many certificates that apparently they can do whatever the fuck they want and no one can do anything, because everyone is afraid of breaking browsing for many users.

I say, break it. People will get annoyed, but they will notice. They will learn what happened. A lot of companies will need to spend time and money on new certificates. Let them. They'll learn who fucked them over, and learn to be more careful with who to trust. Not doing anything shows only that the chain of trust is toothless.

[0] - https://bugzilla.mozilla.org/show_bug.cgi?id=647959

Does anyone have a copy of the certificate used by PrivDog? If so, please publish it for examination. Is it signed by Comodo's CA? If so, they've acted improperly as a certificate authority. That's grounds for revocation of their CA privileges.

"PrivDog recreates a key/cert on every installation" - I don't think it can be signed with a chain rooted at the Comodo CA if its regenerated on the installed machine, but would be good to confirm.

Reply on news.ycombinator.com