Yea, I understand, if one particular government would block website in any place on the Earth, then it is fine. Because it is labeled by the special terminology (“sanctions”) and it is issued by this particular government.
There is joke in my country “It is different – you do not understand” for such a situation.
IMHO: it would lead to the Internet compartmentation. Because more and more tools under control of different government would be blocked. Sometimes just for precaution, not for real tool misuse. There is a good terminology for this too:
“business continuity”.
The current international CAs have a forecast to only decrease market share. Because many other governments see evidence and the need for “business continuity”.
Hence, if a new CA would not be immune against any other government misuse – it would have low value. Sooner or later – it would be cornered to the region with the particular jurisdiction. It would not help against “Internet compartmentation”.
I am answering why “non-profit” organization (in the same jurisdiction) would not help.
Of course, it is possible to put aside the goal to avoid “Internet compartmentation”, and concentrate only on “CAs independently applying rules to limit who can participate on the web” for the particular jurisdiction.
Because other jurisdictions are not protected anyway, it is a too big challenge, right?
Eduard
From: Ted Hardie <ted.ietf@xxxxxxxxx>
Sent: Tuesday, August 13, 2024 12:35
To: Vasilenko Eduard <vasilenko.eduard@xxxxxxxxxx>
Cc: Nick Lockheart <lists@xxxxxxxxxxxxxx>; ietf@xxxxxxxx
Subject: Re: TLS Everywhere
Hi Ted,
I am a client of the biggest bank (by all parameters: number of clients, money, whatever) in my country. The US has requested all certificate authorities to ban this bank. They
did cancel certificates that have been prepaid for up to 10 years.
I have manually installed the root certificate in the firefox to access the bank. The majority of people (tens of millions) did follow the advice to use a locally developed browser
that has a proper certificate pre-installed.
Is it a proper example? For all CAs.
Nick's message called the use of Certificate Authorities "a backdoor to Internet censorship", but government-mandated sanctions are a bit different than the CAs independently applying rules to limit who can
participate on the web.
Eduard
From: Ted Hardie <ted.ietf@xxxxxxxxx>
Sent: Tuesday, August 13, 2024 10:28
To: Nick Lockheart <lists@xxxxxxxxxxxxxx>
Cc: ietf@xxxxxxxx
Subject: Re: TLS Everywhere
It sounds like you don't have a problem with TLS, but do have a concern that the CA/Browser forum's choices might limit the number of websites that
are able to use TLS. First, can you indicate any specific CAs which have sought approval and been denied? Specifically are there any that met the baseline requirements (https://cabforum.org/working-groups/server/baseline-requirements/)
and were denied? Have you talked to the CA/Browser forum about this topic?
Second, you mention Let's Encrypt and note it doesn't solve the problem. Acme is meant to lower the administrative burden for getting and using TLS
certificates and it has been an enormous success, in part because Let's Encrypt lowered the cost associated with getting a certificate to zero. The costs of a CA were formerly one of the most serious barriers to deployment. Having one of the available CAs
be both free and easy to configure certainly seems to contribute to an Internet that is both open to all and secure for anyone who cares to press the right buttons. Let's Encrypt is not so much a gatekeeper as a helpful friend holding the door for you.
Third, your call to action is this:
In order for the Internet to remain free and open, we need a system
where websites can use TLS security, and have their pages load in all
major browsers, **without** needing any permission from a TLS
Gatekeeper.
TLS security requires authentication and PKIs are mostly the way that authentication is delivered. If you want to propose other authentication methods
or adopt other authentication methods, I think you'd need to have some evidence that those methods provide equivalent security and are easier to use. Andy has mentioned DANE/TLS-A as an alternative; while it is a possible route away from CAs, it can be daunting
to configure and a wholesale switch to it seems unlikely. Do you have an actual alternative to CAs to propose?
As full disclosure, I was one of the first chairs of ACME and my company (and specifically my group) supports the work of ISRG/Let's Encrypt financially.
I'm very concerned about the move to "TLS Everywhere". Not because I am
opposed to TLS security, but because of how TLS is currently
implemented in major browsers.
The Internet is supposed to be open for all. And historically, it has
been. Anyone can create a website and post it online, and there aren't
any gatekeepers.
The problem with TLS, however, is that all major browsers will block
your website unless you have a certificate signed by one of a small
handful of "Chosen Few" Certificate Authorities that are hard-coded
into the browser.
This effectively means that in order to add TLS to your website, you
need permission from a very small handful of approved people.
This makes the TLS/HTTP2 Internet almost like an app store. You can't
run an app on an iPhone without Apple's permission, and you won't be
able to have a website that isn't blocked, unless you get a signature
from Verisign, Comodo, or "Let's Encrypt".
Let's Encrypt doesn't solve this problem. It's free to put an app in
the Apple app store, too.
It's the permissions, or the gate-keeping, that is the issue.
In order for the Internet to remain free and open, we need a system
where websites can use TLS security, and have their pages load in all
major browsers, **without** needing any permission from a TLS
Gatekeeper.
In short, the current TLS system, as implemented, is a backdoor to
Internet censorship. We need to come together and find a better way.
|
