Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The foundation of a more secure web: Google Trust Services

security.googleblog.com

Post reply on HN
Print view View original

71–80 of 178 posts

Re: The foundation of a more secure web: Google Trust Services

#71

Post by rmhrisk »

niels_olson wrote: post #36
JoshTriplett wrote: post #30

Earlier quoted context omitted.

> this feels wrong, though I can't quite pin point why. It's unusual for a root CA to be run by a service that otherwise has nothing to do with CA issuance, for the primary purpose of issuing certificates for that service's first-party sites, and not for third-party sites. I can't think of a single other example of a single-purpose root CA like this. (The announcement mentions that they might use this to operate as a…

> I can't think of a single other example of a single-purpose CA like this. Department of Defense: http://www.disa.mil/enterprise-services/identity-and-access-...

There are numerous, Microsoft has its own subordinate CA that they operate for their own certificates. Amazon has its own root CA https://www.amazontrust.com/repository/. There are more as well.

Re: The foundation of a more secure web: Google Trust Services

#72

Post by cuckcuckspruce »

aduffy wrote: post #65

You can now have a website secured by a certificate issued by a Google CA, hosted on Google web infrastructure, with a domain registered using Google Domains, resolved using Google Public DNS, going over Google Fiber, in Google Chrome on a Google Chromebook. Google has officially vertically integrated the Internet.

AOL is dead, long live AOL!/s

For serious though, there's not really any lock-in here (yet). You could replace everything from the certificate through the public DNS with GoDaddy and things would work just fine. I don't really see Google moving to close the web parts of this.

Re: The foundation of a more secure web: Google Trust Services

#73

Post by Cyph0n »

aduffy wrote: post #65

You can now have a website secured by a certificate issued by a Google CA, hosted on Google web infrastructure, with a domain registered using Google Domains, resolved using Google Public DNS, going over Google Fiber, in Google Chrome on a Google Chromebook. Google has officially vertically integrated the Internet.

What's remaining is: server written in Go, running on a Google server OS, located on a Google designed server appliance, which is centrally controlled by a Google designed microprocessor, which is finally manufactured in a Google owned semiconductor foundry. Oh, and the sand used for silicon purification is sourced from a Google-owned stretch of beach.

I haven't considered the internals of the datacenter though...

Re: The foundation of a more secure web: Google Trust Services

#74

Post by rmhrisk »

JoshTriplett wrote: post #58
tptacek wrote: post #51

Earlier quoted context omitted.

This is not in fact all that unusual at all.

I've seen many examples of non-root CAs for such purposes, but it seems unusual (though not completely unheard-of) among root CAs. I dug through Mozilla's standard certificate bundle, and found very few such certificates. Amazon has one, but they also use that to issue certificates through AWS. Someone elsewhere in the thread mentioned a DoD root CA. The certificate store has some certificates from companies like Del…

It's actually quite common, another example is Amazon who operates its own root for its SSL certificate needs. Additionally, there is minimal risk profile differences to an unconstrained subordinate CA (like GIAG2 or the equivalent Microsoft subordinate) and a root. One could argue the risk is in fact reduced for a large issuer to be independent because of fewer entities can negativly impact operations.

Re: The foundation of a more secure web: Google Trust Services

#75

Post by chc »

crdoconnor wrote: post #55
algesten wrote: post #3

I have no love for most the major CAs I've interacted with, but this feels wrong, though I can't quite pin point why. Perhaps just a general feeling that all the internet eggs are being put, one by one, in one single alphabet basket.

If they use their browser dominance to gain the upper hand in the certificate issuance market that seems like a violation of anti-trust law.

If they use their data centers to imprison detractors, that also sounds illegal. It doesn't make data centers sketchy on their own, though.

Re: The foundation of a more secure web: Google Trust Services

#77

Post by rmhrisk »

skybrian wrote: post #19
reddiric wrote: post #14

Earlier quoted context omitted.

That's a different issue, and doesn't address what I wrote.

I think it's related? Since certificate transparency is a way of watching what's going on with all certificate providers (or at least the ones that use it), an organization that thinks Google's root is up to no good has a way of checking. It's after the fact, to be sure, but it matters for reputation.

Google has announced an effort to move all CAs to Certificate Transparency, here is a Threatpost piece on the topic - https://threatpost.com/google-to-make-certificate-transparen....

They will already log their public certificates to CT and this will continue given their push for CT.

Re: The foundation of a more secure web: Google Trust Services

#78

Post by elastic_church »

aduffy wrote: post #65

You can now have a website secured by a certificate issued by a Google CA, hosted on Google web infrastructure, with a domain registered using Google Domains, resolved using Google Public DNS, going over Google Fiber, in Google Chrome on a Google Chromebook. Google has officially vertically integrated the Internet.

so like Amazon.

Re: The foundation of a more secure web: Google Trust Services

#79

Post by reddiric »

mastax wrote: post #57
reddiric wrote: post #4

"If you are building products that intends to connect to a Google property moving forward you need to at a minimum include the above Root Certificates." The foundation of a more secure web apparently requires you to trust Google with the entire internet, using their properties as leverage to force it to be so.

Is Google less trustworthy than Go Daddy? Or CNNIC? Or the Hong Kong Post Office? Yes the CA system is broken but framing that as an anti-Google argument seems silly.

I didn't make a claim if they were trustworthy. Google has leveraged their properties to force people to trust them with the rest of the internet, regardless of if you think they are trustworthy or not.

Re: The foundation of a more secure web: Google Trust Services

#80

Post by viraptor »

cuckcuckspruce wrote: post #72
aduffy wrote: post #65

You can now have a website secured by a certificate issued by a Google CA, hosted on Google web infrastructure, with a domain registered using Google Domains, resolved using Google Public DNS, going over Google Fiber, in Google Chrome on a Google Chromebook. Google has officially vertically integrated the Internet.

AOL is dead, long live AOL!/s For serious though, there's not really any lock-in here (yet). You could replace everything from the certificate through the public DNS with GoDaddy and things would work just fine. I don't really see Google moving to close the web parts of this.

We still need to make choices that guarantee it's the case in the future. We need to ensure we don't end up with environment as diverse as email where most people use Gmail, or Linux services which are all being rewritten under systemd, or many other cases where we voluntarily choose a monoculture that can force our choices in the future...
Post reply on HN