Let’s Take Back The Certificate Authority
1–10 of 15 posts
Re: Let’s Take Back The Certificate Authority
#2I disagree with this completely. The CA Model is absolutely flawed, and this is just patching a flawed model. I'd love to see a push for [DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...) - where you publish your public key in DNS. When doubled with DNSSEC, this means your IP address is irrefutably tied to your domain and so is your TLS public key.
Re: Let’s Take Back The Certificate Authority
#3I disagree with this completely. The CA Model is absolutely flawed, and this is just patching a flawed model. I'd love to see a push for [DANE]( https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... ) - where you publish your public key in DNS. When doubled with DNSSEC, this means your IP address is irrefutably tied to your domain and so is your TLS public key.
DNSSEC has the problem that you rely on root certificates as well - which are ultimately controlled by state actors. Where this goes we know already.
Re: Let’s Take Back The Certificate Authority
#4I disagree with this completely. The CA Model is absolutely flawed, and this is just patching a flawed model. I'd love to see a push for [DANE]( https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... ) - where you publish your public key in DNS. When doubled with DNSSEC, this means your IP address is irrefutably tied to your domain and so is your TLS public key.
DNSSEC has the problem that you rely on root certificates as well - which are ultimately controlled by state actors. Where this goes we know already.
Well we have a hell of a lot more transparency about where that key is, who generated and has access to it. There's a video of the entire ceremony online somewhere, at the moment I can only find [this summary](https://www.youtube.com/watch?v=b9j-sfP9GUU)
Re: Let’s Take Back The Certificate Authority
#5Earlier quoted context omitted.
DNSSEC has the problem that you rely on root certificates as well - which are ultimately controlled by state actors. Where this goes we know already.
Well we have a hell of a lot more transparency about where that key is, who generated and has access to it. There's a video of the entire ceremony online somewhere, at the moment I can only find [this summary]( https://www.youtube.com/watch?v=b9j-sfP9GUU )
DANE is an interesting concept for sure. Not 100% viable in the short-term but going forward we need to start thinking of a better solution. It would still be cert based and just add a layer of complexity. The cert model works it's just controlled by the wrong people and lacks regulation.
Re: Let’s Take Back The Certificate Authority
#6I disagree with this completely. The CA Model is absolutely flawed, and this is just patching a flawed model. I'd love to see a push for [DANE]( https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... ) - where you publish your public key in DNS. When doubled with DNSSEC, this means your IP address is irrefutably tied to your domain and so is your TLS public key.
DNSSEC has the problem that you rely on root certificates as well - which are ultimately controlled by state actors. Where this goes we know already.
True, we need a better way to control it. The wrong companies are becoming authorities for the wrong reasons. We at least need more transparency on the verification process. I would also like to see a public list of cert requests that failed the approval process. It could be interesting data for incident responders.
Re: Let’s Take Back The Certificate Authority
#7Doesn't this already exist in the form of CAcert?
Re: Let’s Take Back The Certificate Authority
#8I disagree with this completely. The CA Model is absolutely flawed, and this is just patching a flawed model. I'd love to see a push for [DANE]( https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... ) - where you publish your public key in DNS. When doubled with DNSSEC, this means your IP address is irrefutably tied to your domain and so is your TLS public key.
Another alternative: http://en.wikipedia.org/wiki/Convergence_(SSL)
See Moxie Marlinspike’s talk from DEFCON 19 http://www.youtube.com/watch?v=pDmj_xe7EIQ
Re: Let’s Take Back The Certificate Authority
#9How does this proposal compare to TACK: http://tack.io ?
Re: Let’s Take Back The Certificate Authority
#10I ran the technical side of a global CA for 5 years (left the industry early this year) and I can tell you that while validation (outside of EV) is relatively simple, the technical/legal/audit aspects add up to a significant cost.
If you want to run a CA you need to obtain sufficient funding (on an ongoing basis, these aren't all one-time costs) to do things properly. Properly means expensive audits, expensive HSMs, expensive secure rooms with multi-factor authentication to enter, auditing of all actions, long-term record retention, reliable and performant OCSP responders, endless documentation (DR, secure hardware lifecycle policies, etc), being an active member of the CABForum to drive your agenda and keep abreast of changing industry requirements, and much, much more. Of course, by doing so you are attempting to upend a multi-billion dollar industry, so expect a political fight with the CAs and potentially the browsers as well...
These problems are part of what lead people to prefer replacing the industry (DANE, Convergence, TACK) over building a non-profit CA in the existing model. Of course, replacement comes with its own huge set of obstacles.
All that said, if you're a company with a bunch of money you want to spend on this problem, let me know. I am willing to lend a hand.