101–110 of 178 posts
Couple of notes: * pki.goog does not enforce TLS * Why use .goog instead of .google?
While it would be ideal for that not to be the case, one has to build out infrastructure that supports the way UAs behave today.
You can now have a website secured by a certificate issued by a Google CA, hosted on Google web infrastructure, with a domain registered using Google Domains, resolved using Google Public DNS, going over Google Fiber, in Google Chrome on a Google Chromebook. Google has officially vertically integrated the Internet.
/cynical off
Hmm, I wonder if Alphabet will spin up a made at Google alternative to Let's Encrypt?
Earlier quoted context omitted.
The certificates are OK. The issue is the way they are signed and distributed. Lots of issues with the current PK infrastructure is limited by the certificate transparency.
As I see it, there are a number of issues that need to be cleared up before certs are anything more than snake-oil. Unfortunately, the economics of the current market-reality fight (tooth and nail) against doing so. (Note that I'm limiting this to browser certificate handling.) - We need clients to authenticate servers as well as the reverse. - Browsers need to allow better user control over certificates. I know the…
Being trustworthy means fulfilling the expectations of the party that is reliant on us, and which are based on what we promise. Currently, the CA system promises very little, with the general idea being that your data is safe from thieves and scammers; certainly not that your communications are safe from law enforcement. Therefore, they are mostly trustworthy.
If you start telling people that you can say which CAs are free from interference from intelligence agencies and other top-level snoopers, you're making a much stronger promise, and therefore any flaws in your assessment are much more dangerous.
"If you are building products that intends to connect to a Google property moving forward you need to at a minimum include the above Root Certificates." The foundation of a more secure web apparently requires you to trust Google with the entire internet, using their properties as leverage to force it to be so.
Earlier quoted context omitted.
What's remaining is: server written in Go, running on a Google server OS, located on a Google designed server appliance, which is centrally controlled by a Google designed microprocessor, which is finally manufactured in a Google owned semiconductor foundry. Oh, and the sand used for silicon purification is sourced from a Google-owned stretch of beach. I haven't considered the internals of the datacenter though...
Go poke around: https://research.google.com/pubs/papers.html You will see lots of custom stuff that Google does. There are many things that are better to outsource to 3rd parties, but many things are better in-house because the solutions just don't exist or they cost too much for the volume they need. Some examples: Network routers for CLOS topology (there are pictures of some of the hardware): https://research.googl…
If you are building products that intend to connect to a Google property moving forward you need to at minimum include the above Root Certificates. With that said even though we now operate our own roots, we may still choose to operate subordinate CAs under third-party operated roots. For this reason if you are developing code intended to connect to a Google property, we still recommend you include a wide set of trustworthy roots. Google maintains a sample PEM file at ( https://pki.goog/roots.pem ) which is periodically updated to include the Google Trust Services owned and operated roots as well as other roots that may be necessary now, or in the future to communicate with and use Google Products and Services
Earlier quoted context omitted.
Is Google less trustworthy than Go Daddy? Or CNNIC? Or the Hong Kong Post Office? Yes the CA system is broken but framing that as an anti-Google argument seems silly.
Google isn't less trustworthy, but it is far closer to being a monopoly. I would like to bias towards a more decentralized infrastructure. Especially since Google is US based.