Digicert Withdraws from the CA Security Council
digicert.com
Digicert Withdraws from the CA Security Council
1–10 of 73 posts
Re: Digicert Withdraws from the CA Security Council
#2I'd be curious the real reasons for this, because the reasons listed in this press release sound like marketing-speak.
Re: Digicert Withdraws from the CA Security Council
#3Note that this is not the CA/Browser Forum, the usual industry association you hear about. The CA Security Council is a group of a small number of old-guard CAs, which has been notable recently for pushing a distinction between (automatic) domain validation, organizational validation, and Extended Validation, mostly as a response to Let's Encrypt. The "London Protocol" appears to be a proposal for formalizing the distinction between DV and OV + EV: https://casecurity.org/2018/06/27/the-london-protocol/
If you look at this previous paper they (Entrust + Comodo) published, they're proposing that OV and EV certificates get padlocks and DV ones don't: https://casecurity.org/wp-content/uploads/2017/09/Incidence-... Or, in other words, you can't get a padlock from Let's Encrypt and you'll have to pay them for a padlock.
Compare with Google's plan at https://blog.chromium.org/2018/05/evolving-chromes-security-... which just drops the padlock for everyone, treats plaintext HTTP as affirmatively insecure, and stops pretending that paying money to a CA means that you're a morally upright website.
A CA leaving the CASC seems like a good thing for the world.
Re: Digicert Withdraws from the CA Security Council
#4Note that this is not the CA/Browser Forum, the usual industry association you hear about. The CA Security Council is a group of a small number of old-guard CAs, which has been notable recently for pushing a distinction between (automatic) domain validation, organizational validation, and Extended Validation, mostly as a response to Let's Encrypt. The "London Protocol" appears to be a proposal for formalizing the dis…
It's an interesting question: is there value to certificate identity verification ?
Apple's App Store for example demands that companies wanting to publish apps have to undergo a verification process using a DUNS number. And this has been useful for example in resolving trademark and DMCA disputes. But not really sure if it's improved security in any way.
Re: Digicert Withdraws from the CA Security Council
#5Note that this is not the CA/Browser Forum, the usual industry association you hear about. The CA Security Council is a group of a small number of old-guard CAs, which has been notable recently for pushing a distinction between (automatic) domain validation, organizational validation, and Extended Validation, mostly as a response to Let's Encrypt. The "London Protocol" appears to be a proposal for formalizing the dis…
Also - CASC member Entrust Datacard told Troy Hunt (the Have I Been Pwned guy) that the London Protocol meant that they were going to "phase out insecure DV certificates": https://twitter.com/troyhunt/status/1012190910254235649
CASC member GoDaddy cold-called a random musician with an HTTP site and told her the only way to avoid an SSL warning from Google would be to pay them $200+: https://www.facebook.com/rebecca.ann.925/posts/1740244236062...
I can see why Digicert would want to run from the CASC and keep their reputation safe.
(from Ryan Sleevi of Chrome's crypto team https://twitter.com/sleevi_/status/1012338888088719360 - searching for his other interactions with the CA Security Council is pretty enlightening too)
Re: Digicert Withdraws from the CA Security Council
#6Note that this is not the CA/Browser Forum, the usual industry association you hear about. The CA Security Council is a group of a small number of old-guard CAs, which has been notable recently for pushing a distinction between (automatic) domain validation, organizational validation, and Extended Validation, mostly as a response to Let's Encrypt. The "London Protocol" appears to be a proposal for formalizing the dis…
It's an interesting question: is there value to certificate identity verification ? Apple's App Store for example demands that companies wanting to publish apps have to undergo a verification process using a DUNS number. And this has been useful for example in resolving trademark and DMCA disputes. But not really sure if it's improved security in any way.
Apple's case is a little different because it lets you publish native code on the phone. (You can argue that websites effectively also publish code, but the web sandbox is probably quite a bit stronger than the iOS one.)
I don't think there's much advantage in knowing that you're some registered organization. It's pretty easy to register an organization - see e.g. https://stripe.ian.sh , to which the CASC responded by proposing the rule "Applicants that have been in existence for less than 18 months are not eligible for EV certificates," as well as a requirement that the CA inspect your tax returns to make sure you're a bona-fide business. This is basically a losing game (losing for the CAs, because it won't work, and losing for the world, because startups can't get EV certificates and everyone else loses their privacy), hence my comment about validating that you're a morally upright website. It's the evil bit, except as a TLS extension.
One thing that does have value, though, is making sure a website is the right website. It's perfectly fine for https://stripe.ian.sh to have a cert as long as they don't get my https://stripe.com credentials or cookies. On the cookie side, the browsers already solve this with the same-origin policy, so the hard part is just making sure that you don't enter usable login credentials on the wrong website (i.e., preventing phishing, which is the stated goal of CASC). There are pretty good solutions for this like FIDO/FIDO2 - in the future I'd like to see places like banks either giving you U2F security keys or letting you bring your security key in when you enroll for an account and activate it on their machine, because the FIDO protocol lets the security key participate in the same-origin policy. If I've enrolled my key with bankofamerica.com, and my login requires using a security key, I can't divulge usable credentials to bankofamerica-secure-login-trust-me.com.
Relatedly, the same-origin policy doesn't (and can't) distinguish between the type of HTTPS you have or whether there's a verified organization name on the cert. It treats any HTTPS for the same domain as the same origin. So the browser makers have been pushing back against meaningful distinctions between DV, OV, and EV (and also against EV even having any costmetic distinctions), which is completely at odds with the CASC's strategy. Sucks for the CASC because it means a $0 Let's Encrypt certificate is as meaningful as a $300+ EV certificate, but I think the browser makers are right, here.
Re: Digicert Withdraws from the CA Security Council
#7I'd be curious the real reasons for this, because the reasons listed in this press release sound like marketing-speak.
Exactly what I was thinking as I read it.
Re: Digicert Withdraws from the CA Security Council
#8Earlier quoted context omitted.
It's an interesting question: is there value to certificate identity verification ? Apple's App Store for example demands that companies wanting to publish apps have to undergo a verification process using a DUNS number. And this has been useful for example in resolving trademark and DMCA disputes. But not really sure if it's improved security in any way.
Apple's case is a little different because it lets you publish native code on the phone. (You can argue that websites effectively also publish code, but the web sandbox is probably quite a bit stronger than the iOS one.) I don't think there's much advantage in knowing that you're some registered organization. It's pretty easy to register an organization - see e.g. https://stripe.ian.sh , to which the CASC responded b…
I hadn't actually even _heard_ of "OV" before. Googling... I still can't tell what the difference between it and EV is supposed to be, other than how much someone paid a CA.
Re: Digicert Withdraws from the CA Security Council
#9Earlier quoted context omitted.
It's an interesting question: is there value to certificate identity verification ? Apple's App Store for example demands that companies wanting to publish apps have to undergo a verification process using a DUNS number. And this has been useful for example in resolving trademark and DMCA disputes. But not really sure if it's improved security in any way.
Apple's case is a little different because it lets you publish native code on the phone. (You can argue that websites effectively also publish code, but the web sandbox is probably quite a bit stronger than the iOS one.) I don't think there's much advantage in knowing that you're some registered organization. It's pretty easy to register an organization - see e.g. https://stripe.ian.sh , to which the CASC responded b…
> but the web sandbox is probably quite a bit stronger than the iOS one.
I really don't think that's true, purely by thinking about the number of iOS jailbreaks that have been published recently Vs the number of browser exploits.
Security is part of the reason Apple charges like it does, but it is only part and I'm not sure the distinction between the Chrome and iOS sandbox is much of a factor.
Re: Digicert Withdraws from the CA Security Council
#10Earlier quoted context omitted.
Apple's case is a little different because it lets you publish native code on the phone. (You can argue that websites effectively also publish code, but the web sandbox is probably quite a bit stronger than the iOS one.) I don't think there's much advantage in knowing that you're some registered organization. It's pretty easy to register an organization - see e.g. https://stripe.ian.sh , to which the CASC responded b…
I hadn't actually even _heard_ of "OV" before. Googling... I still can't tell what the difference between it and EV is supposed to be, other than how much someone paid a CA.
OV is EV where you also get the business name in the URL bar.