Earlier quoted context omitted.
https://www.amazontrust.com
To clarify, that's a CA, not an ISP
But as Google wants to stop the Fiber project, they will also stop being one. Apparently being an ISP adds no value to the rest.
The foundation of a more secure web: Google Trust Services
151–160 of 178 posts
Re: The foundation of a more secure web: Google Trust Services
#152Earlier quoted context omitted.
As far as I can tell, this is more like Goog gathering their own eggs in their own basket. They are becoming more and more self-sufficient, but don't really seem that interested in taking over the whole market. As long as it stays that way, I don't mind much.
They have the most popular browser, mobile OS, search engine. They operate popular public DNS servers too. They add this cert and they control a vast chunk of the internet.
But there's no real lock-in effect. It's very easy to switch search engines, but rarely anyone does it because Google's simply better than Bing. If someone else comes up with better algorithms I'm sure that people would start switching. But very few people switch just to avoid the monopolist.
Same for Google Chrome. Switching to another browser is a matter of a few minutes (including taking the data with you). But as long as Chrome is at least as good as the others, there's no reason to do so.
I think it's important to recognize the differences between monopolists with lock-in (e.g. Microsoft with Windows and Office) and those without lock-in. Even though I'm also concerned about the amount of data that Google has, I'm sure they'll at some point end up like Yahoo or AOL. The question only is how long it takes.
IMO Microsoft is only around because they could generate revenues from lock-in effects during years where their new products were really bad. They've caught up now and did a lot right in the last years (and already benefit from it financially). But if they'd only had a portfolio like Google, I'm not sure they would still play a role.
Re: The foundation of a more secure web: Google Trust Services
#153I have no love for most the major CAs I've interacted with, but this feels wrong, though I can't quite pin point why. Perhaps just a general feeling that all the internet eggs are being put, one by one, in one single alphabet basket.
I guess I'm not the only one who's noticed the steady stream of "Do x with google" on the frontpage. This is what's unsettling me, they seem to want to seep into every last crack of our lives, starting with all things web. Edit: At least it felt like a slow stream to me. Search isn't being very cooperative towards my cause right now... The only item matching my memory is https://news.ycombinator.com/item?id=13013494…
On the other hand, they still lag behind Microsoft and Amazon when it comes to cloud efforts. Yes, they clearly dominate search and ads, but the topics discussed here are mostly cloud-services related. And there, most is done via AWS and increasingly also via Azure (esp. enterprises). Google Cloud doesn't dominate that in any way.
Re: The foundation of a more secure web: Google Trust Services
#154Earlier quoted context omitted.
Many websites are not country specific. They started somewhere and are headquartered somewhere, but it is not something users should need to remember.
Using the global TLDs for a global site is fine. But I wish there was a rule against using .com/.org/... domains for sites that are restricted to a single country (e.g. a shop that only ships to the USA should be under .us)
This is the case in nearly all countries except the US. In the UK, nearly all shops will have a .co.uk domain. In Germany .de domains, etc. It's just that .com is believed to be the US equivalent for that, not an international domain.
That's also how large sites handle it. Amazon.com will lead you to the US page, not to an international section (e.g. where you could choose where to go).
Re: The foundation of a more secure web: Google Trust Services
#155Earlier quoted context omitted.
I would like to see a single responsible CA for each domain (which are allowed to hierarchically delegate). Country-specific agencies should only be able to sign domains within their country, and .com addresses (which should be reserved for genuinely international sites, though that's a separate argument) should be handled by an international CA that can a) apply some consistent international standard for how domain…
So... one CA for each domain, leaving no competition? And which unwanted domain will LetsEncrypt be left with, then? Back in the real world, we have multiple CAs who have accountability for lots of overlapping domains. You can wish for some other non-existent situation, everyone else has to make the best of the situation as it stands.
> So... one CA for each domain, leaving no competition? And which unwanted domain will LetsEncrypt be left with, then?
Domains can compete with each other, particularly given the big opening up of TLDs. We could have actual competition between CAs at the end-user-facing level because it'd be visible to the user who the CA was (the CA and the registry ought to be merged - at the moment they're two parallel sets of infrastructure for doing the same thing), and if particular domains/CAs had poor-quality identity checking users might actually start to notice. As opposed to today, where the only one who knows which CA a domain might be using is the domain owner, and so the incentive largely is for the CA to do as little checking as possible.
> Back in the real world, we have multiple CAs who have accountability for lots of overlapping domains. You can wish for some other non-existent situation, everyone else has to make the best of the situation as it stands.
There's a migration path. Enable DNSSEC/DANE with all CAs authorized for all domains initially, then allow countries / TLD owners to start restricting who can sign certificates for their domains. If Hong Kong moved to requiring only Hong Kong Post Office to sign their domains, we could see how well or badly that model works - if it reduces phishing / spying then other countries will follow the same, if it stifles innovative internet businesses then they'll move away from that. But 150+ entities all having the power to own every site on the internet can't possibly be the right model.
Re: The foundation of a more secure web: Google Trust Services
#156[deleted]
Re: The foundation of a more secure web: Google Trust Services
#157You can now have a website secured by a certificate issued by a Google CA, hosted on Google web infrastructure, with a domain registered using Google Domains, resolved using Google Public DNS, going over Google Fiber, in Google Chrome on a Google Chromebook. Google has officially vertically integrated the Internet.
And you can discover such website using Google (the search engine).
Re: The foundation of a more secure web: Google Trust Services
#158I don't think this is a bad thing. Instead of a third-party you trust (or rather, your user-agent trusts) vouching that Google's indeed Google, it's now Google vouching for itself, and you trust them by the virtue that they're Google. This ought not be surprising: presumably, who better to say that Google is indeed Google than Google itself? The reason everyone doesn't run a root CA is because it's difficult to coord…
> I don't think this is a bad thing. Instead of a third-party you trust (or rather, your user-agent trusts) vouching that Google's indeed Google, it's now Google vouching for itself, and you trust them by the virtue that they're Google.
I'ts like a self signed certificate.
Re: The foundation of a more secure web: Google Trust Services
#159Earlier quoted context omitted.
The certificates are OK. The issue is the way they are signed and distributed. Lots of issues with the current PK infrastructure is limited by the certificate transparency.
The main issue I see is ease of MITM for corporate environments. In a corporate environment a trusted root is installed, then an appliance can intercept all SSL certs and re-create the trust chain to introduce their own trusted root so they can read all SSL traffic and your browser says "SECURE". That is broken IMO.
Are there any conceivable architectures where whoever owns the computer couldn't MITM themselves? If only for debugging purposes, which would immediately be used by corporate IT for the usual purpose.
Re: The foundation of a more secure web: Google Trust Services
#160Earlier quoted context omitted.
> We need to ensure we don't end up with environment as diverse as email where most people use Gmail Good luck making something that's both 1) the most convenient and 2) not centralized.
good luck? with that attitude you deserve shitty centralized systems that spy on you. decentralization and ease of use aren't contradictory anyway. remember bit torrent? used to be very popular, even among less technical users. great UX too. click a magnet link and you have your content in a flash. the problem is that there isn't a multi-billion dollar business case for decentralized user systems. a lot of server/dc…
Spam blocking is a problem that's very difficult to solve without massive scale. Decentralized email used to suck for filtering spam because they simply didn't have the scale needed to recognize spam reliably.
WordPress solved the spam issue for decentralized blog comments by centralizing it, which gives them the scale to solve it well but also gives them the ability to read probably half the blog comments on the web in real time.