I love that you can just buy a CA and devices will trust the new owner. That’s not messed up or anything.
How could you design a system that works otherwise? Computer security is always about "this key says", not "this legal entity says".
The foundation of a more secure web: Google Trust Services
11–20 of 178 posts
Re: The foundation of a more secure web: Google Trust Services
#12I love that you can just buy a CA and devices will trust the new owner. That’s not messed up or anything.
WoSign/StartCom got a bit of a smackdown about their stealth acquisition so there is some level of oversight.
Re: The foundation of a more secure web: Google Trust Services
#13"If you are building products that intends to connect to a Google property moving forward you need to at a minimum include the above Root Certificates." The foundation of a more secure web apparently requires you to trust Google with the entire internet, using their properties as leverage to force it to be so.
It basically Google scratching their own itch and their PR people having to polish this stuff by inserting expressions like "more secure" and "moving forward".
It's disgusting but pretty much corporate life 101.
Re: The foundation of a more secure web: Google Trust Services
#14"If you are building products that intends to connect to a Google property moving forward you need to at a minimum include the above Root Certificates." The foundation of a more secure web apparently requires you to trust Google with the entire internet, using their properties as leverage to force it to be so.
You may want to look into certificate transparency and who's supporting it.
That's a different issue, and doesn't address what I wrote.
Re: The foundation of a more secure web: Google Trust Services
#15It feels like a new age of internet when we have stuff like Googles private .goog gtld with domains signed by Googles private Root CA. It's not strictly bad (and I'm not complaining), but it feels bit silly/weird/scary/... .
Re: The foundation of a more secure web: Google Trust Services
#16I think SSL certificates need to be replaced. Security can NOT be designed with the 'good guy' in mind. if it can be broken at all we need an alternative.
The certificates are OK. The issue is the way they are signed and distributed. Lots of issues with the current PK infrastructure is limited by the certificate transparency.
The certificates have their own, independent problems (who thinks x509 is a good format?)
Re: The foundation of a more secure web: Google Trust Services
#17Earlier quoted context omitted.
You may want to look into certificate transparency and who's supporting it.
That's a different issue, and doesn't address what I wrote.
Actually it does address your point about trust; CT severely limits the amount of trust we need to place to any single participating CA, including now Google.
Re: The foundation of a more secure web: Google Trust Services
#18I think SSL certificates need to be replaced. Security can NOT be designed with the 'good guy' in mind. if it can be broken at all we need an alternative.
The certificates are OK. The issue is the way they are signed and distributed. Lots of issues with the current PK infrastructure is limited by the certificate transparency.
it is too hard for me to believe that root ca's have not been compromised when anyone working at these companies could likely easily take it without anyone noticing. I do not think transparency has anything at all to do with it.
I think an encryption solutions that cannot be 'broken' for decryption is far more required than one that has the 'good guy' in mind. I do not find it an acceptable solution for critical data.
Re: The foundation of a more secure web: Google Trust Services
#19Earlier quoted context omitted.
You may want to look into certificate transparency and who's supporting it.
That's a different issue, and doesn't address what I wrote.
I think it's related? Since certificate transparency is a way of watching what's going on with all certificate providers (or at least the ones that use it), an organization that thinks Google's root is up to no good has a way of checking.
It's after the fact, to be sure, but it matters for reputation.
Re: The foundation of a more secure web: Google Trust Services
#20Earlier quoted context omitted.
The certificates are OK. The issue is the way they are signed and distributed. Lots of issues with the current PK infrastructure is limited by the certificate transparency.
it is too hard for me to believe that root ca's have not been compromised when anyone working at these companies could likely easily take it without anyone noticing. I do not think transparency has anything at all to do with it. I think an encryption solutions that cannot be 'broken' for decryption is far more required than one that has the 'good guy' in mind. I do not find it an acceptable solution for critical data…
Not any transparency. Certificate transparency.