31–37 of 37 posts
Earlier quoted context omitted.
If you are a certificate authority, you can issue certificates for any domain. There is nothing in the technology preventing you from issuing a whitehouse.gov certificate merely because you are based in Iran, for example.
Who is going to sign it?
Earlier quoted context omitted.
I agree TLS should be more widely used. But... When the government or ISP in question controls its own certificate authority (and many do), they can MITM you even over HTTPS. Yes, it's another speedbump for them to get over. No, it's not going to stop them. The X.509 security model is broken and needs fixing or replacing.
Are there any certifying authorities which can be considered relatively free of government/corporate control?
Earlier quoted context omitted.
Who is going to sign it?
Who is going to sign what? If you mean the certificates that the certificate authority issues, then the certificate authority signs them itself. If you mean who signs the certificate authority's authority certificate, then either another certificate authority signs it, or the certificate authority signs it itself and pays the browser makers to include it as a root certificate in their browsers. I'm not sure what you'…
Earlier quoted context omitted.
Who is going to sign what? If you mean the certificates that the certificate authority issues, then the certificate authority signs them itself. If you mean who signs the certificate authority's authority certificate, then either another certificate authority signs it, or the certificate authority signs it itself and pays the browser makers to include it as a root certificate in their browsers. I'm not sure what you'…
What is the chance of Iran becoming a root CA? Passing a WebTrust audit? It's not like you can become one just by showing up.
If a UAE state-controlled telecoms company can become a CA, why not an Iranian state-controlled telecoms company? Or Chinese?
Earlier quoted context omitted.
You are. You are the certificate authority, and you're trusted. Anything you sign is, by definition, valid.
Except every browser I know will barf at self-signed cert.
Modern browsers today accept a large number of "self-signed" certificates. The key is that the signer paid the browser makers money for that privilege. SSL assumes that those companies are all trustworthy, but is any company trustworthy when the government shows up with guns and asks for the master password to your key signer?
If no, then SSL fails.
Let me summarize because you seem to be misunderstanding: a lot of untrustworthy parties are trusted by browsers. This makes SSL somewhat useful against having a coffee shop steal your Facebook password, but almost certainly useless against having a government steal your password.
This is why login forms themselves must be opened over an HTTPS connection. Displaying a login form over HTTP which POSTs to HTTPS is easily MITMd. Think of your users. Some of them will be accessing your sites from oppressive regimes. Let them do so safely. Taking Facebook as an example, considering how global their usage is, and the amount of sensitive data peoples accounts contain, it's unforgivable that they don'…