Linked by Thom Holwerda on Mon 5th Sep 2011 22:26 UTC
Privacy, Security, Encryption So, people from within Iran have hacked the Dutch company DigiNotar, allowing them to issue fake certificates so they could listen in on Iranian dissidents and other organisation within Iran. This is a very simplified version of the story, since it's all quite complicated and I honestly don't even understand all of it. In any case, DigiNotar detected the intrusion July 19, but didn't really do anything with it until it all blew up in their face this past week. Now, the Dutch government has taken over operational management of DigiNotar... But as a Dutch citizen, that doesn't really fill me with confidence, because, well - whenever the Dutch government does anything even remotely related to IT technology, they mess it up. And mess it up bad.
Thread beginning with comment 488676
To view parent comment, click here.
To read all comments associated with this story, please click here.
Bill Shooter of Bul
Member since:
2006-07-14

Oh, I thought you were asking me what I did, not what Joe computer user people should do.

But for argument's sake,

1)If everyone were to limit their trust to the mythical"good CA's" then yes, it would be a good idea for a website owner to use one of those. All of these points have to assume that is the case, or none of this makes sense.

2)It doesn't have to be individuals, necessary. Browsers are already doing this, although they're doing it quite poorly. It would be better if they had an interface like Adblocker that allowed you to choose from some preconfigured list of ca's. Yes, this is trusting other people to trust Ca's who trust websites. Which is a lot of trust going around, but I actually think it would be better.

2b)Yes, Popularity with big trustworthy sites. I trust large websites who have good security minds to select their CA roots. Other people should too.

Edit Comment:
That would be an improvement, but would require CA's to work together.

Reply Parent Score: 2

Alfman Member since:
2011-01-28

Bill Shooter of Bul,

"Yes, Popularity with big trustworthy sites. I trust large websites who have good security minds to select their CA roots. Other people should too."

This immediately rubs me the wrong way because I have a strong bias against promoting large corporate oligopolies. Anyway, assuming large popular CAs are generally more secure than small ones, then logically we should restrict our business and trust to large scale vendors. The problem I have is that this crushes smaller competitors, some of whom might actually be more secure and more deserving of our business.

Maybe a bank has vetted small vendor X as extremely secure and competitive, but the bank never the less decides to go with a larger vendor Y because Y is on the popular CA whitelist and X is not.

I have to admit that a few large & secure CAs seems more secure than hundreds of smaller ones. (I really hesitated to write this, such is my resentment for monopolies/oligopolies).


"Edit Comment:
That would be an improvement, but would require CA's to work together."


I was thinking that one would just acquire two certificates from two CA's, and transmit them both to the client for validation. No CA cooperation needed. However I guess you were thinking of having two CA's sign the same CSR to create one certificate, which would also work. I'd still prefer a DNS based solution though.

Edited 2011-09-07 03:15 UTC

Reply Parent Score: 2

Bill Shooter of Bul Member since:
2006-07-14

Yeah, its not easy to be a a small company in tech. Maybe there needs to be something simular to PCI or HIPPA standards for CA's. While those aren't perfect, they're better than nothing.

I'd be interested in SSL certs being in DNS records, although I'd need to think through the implementation. Registrars aren't very secure these days either, looking at the recent Register Hack.

Reply Parent Score: 2