Viewing profile — sleevi

All the time. Many CA distrust events involved some degree of “amateurs” reporting issues. While I hesitate to call commenters like agwa an amateur, it certainly was not profession…

Because it wasn’t actually a server misconfiguration, nor was it, as others have speculated, about Postel’s Law. The way X.509 was designed - to the very first version - was the no…

Because this is not the “start of drafting” but roughly “final text that is largely a rubber stamp approval.” This is the output of having been through the the trilogue process - w…

> and the recent legislation coming from there seems very inspired by the great firewall. https://www.europarl.europa.eu/RegData/etudes/STUD/2020/6487...

The EU is currently proposing to mandate the inclusion of roots that have been government approved, and to limit browsers from removing/distrusting them without notice/approval. ht…

It’s actually a huge issue - look at how eliminating a key difficulty in obtaining certificates massively increased HTTPS adoption (via LetsEncrypt and others) Similarly, automatio…

Yes, the current regulation is targeted at government sites authenticating citizens, but the goal with these revisions is to require VLOPs to support this, along with allowing them…

The QWACs can be issued by anyone who meets the minimum requirements, which are substantially less than those required for TLS server CAs in browsers. So while it’s true that banks…

The proposed regulation requires that QWACs MUST be accepted and recognized as such, such as using the European List of Trusted Lists as part of the root store. That is, if a QWAC …

One element that results in less security is that it becomes more difficult to replace. For example, QWACs cannot legally be automated (e.g. via ACME), because of certain restricti…

Yes. It requires the EU Trustmark, a logo designed through a secondary-school competition, to be displayed with certain colors and sizing, as directed through Implementing Acts (wh…

The draft revisions actually propose such authentication to be mandatory to implement for service providers if their users would like to use it. That is, it specifically targets we…

https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A20...

Do you have links to documentation on the Apple Pay requirement? That sounds like Apple Pay is encouraging certificate pinning, and I suspect the Apple Root Program may have opinio…

As others have noted, many of these issues are fundamental to XML DSig, which is insecure by design. [1] However, the “what does the future hold” of OIDC is not much brighter. OIDC…

Example app: NuGet for .NET on Linux and MacOS, from Microsoft: https://github.com/NuGet/Announcements/issues/56 It used SSL/TLS and S/MIME roots to verify code signing and timesta…

Using (defined) properties of the TLS ClientHello to determine how the server will respond. For example, changing the certificate used based on the ALPN identity, the SNI server ho…

No more related to Android than any other Chrome supported OS. The post linked in the article, https://g.co/chrome/root-policy makes it clear: the goal is to provide a consistent, …

https://cloud.google.com/docs/chrome-enterprise/policies?pol... There’s more that could be said, but I can see this is an emotionally loaded subject for you, so perhaps it’s best d…

Some of this isn’t correct (e.g. Firefox totally reads HKCU - https://searchfox.org/mozilla-central/source/security/manage... - which is necessary to work with AV ), but I’ll the t…

Happy to be up front here: as we call out in https://g.co/chrome/root-policy , the goal is to support the things the user installed and authorized. The priority of constituencies f…

No, that’s not it: none of the code has landed yet It’s a big enough change that we’re explaining before landing. We’re taking an approach similar to Firefox’s implementation ( htt…

https://g.co/chrome/root-policy , which is linked to in that mail, states in the third paragraph: > If you’re an enterprise managing trusted CAs for your organization, including lo…

The overlay is only used by Chrome on ChromeOS (the doc goes into some of the details there), so effectively, the “Chrome OS” root store is being sunset. On a practical, technical …