On 13 Aug 2024, at 17:18, Pierce Gorman wrote: > I will argue the IETF is scoped to discuss protocol-based solutions to the problem of multi-factor trust anchorage. With all due respect, Ted wrote "the IETF list", not "the IETF". Patrik > A Relying Party may require more than is available from domain-based or EV certification and need the ability to expose RP requirements and also verify representations of trustworthiness from issuers and holders of credentials proposed to meet those requirements. > > Pierce > > From: Ted Hardie <ted.ietf@xxxxxxxxx> > Sent: Tuesday, August 13, 2024 8:12 AM > To: Vasilenko Eduard <vasilenko.eduard@xxxxxxxxxx> > Cc: Nick Lockheart <lists@xxxxxxxxxxxxxx>; ietf@xxxxxxxx > Subject: The impact of sanctions (was Re: TLS Everywhere) > > You don't often get email from ted.ietf@xxxxxxxxx<mailto:ted.ietf@xxxxxxxxx> . Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> > > > EXTERNAL EMAIL > Hi Eduard, > > Nick's original assertion was that there was a small number of CAs and that they were exercising either an exclusion of new CAs or that there were websites that could not get certificates from this small set. It's a much larger set than he posited, and there are ground rules for getting added to that set which have been successfully used by CAs from many different jurisdictions. The certificates they issue are used all over the world and Let's Encrypt alone provides certs to 450 million websites. This simply isn't as hard in the general case as he implied. > > That a particular set of international sanctions has been recognized by that set of CAs is not a problem at the protocol layer, and changing the protocol layer likely won't change the outcome. If you switch to DANE, instead of having the CA/browser forum members receive these requests, the DNS registrars or registries will. Having a specific non-profit in place as an alternative also wouldn't help, because it would be subject to the same set of pressures and it would be a single entity rather than a distributed system. > > The IETF list is not scoped to discuss the actual solutions to your problem, so I will stop here. > > regards, > > Ted Hardie > (as an individual) > > On Tue, Aug 13, 2024 at 1:20 PM Vasilenko Eduard <vasilenko.eduard@xxxxxxxxxx<mailto:vasilenko.eduard@xxxxxxxxxx>> wrote: > Yea, I understand, if one particular government would block website in any place on the Earth, then it is fine. Because it is labeled by the special terminology (“sanctions”) and it is issued by this particular government. > There is joke in my country “It is different – you do not understand” for such a situation. > IMHO: it would lead to the Internet compartmentation. Because more and more tools under control of different government would be blocked. Sometimes just for precaution, not for real tool misuse. There is a good terminology for this too: “business continuity”. > The current international CAs have a forecast to only decrease market share. Because many other governments see evidence and the need for “business continuity”. > Hence, if a new CA would not be immune against any other government misuse – it would have low value. Sooner or later – it would be cornered to the region with the particular jurisdiction. It would not help against “Internet compartmentation”. > > I am answering why “non-profit” organization (in the same jurisdiction) would not help. > > Of course, it is possible to put aside the goal to avoid “Internet compartmentation”, and concentrate only on “CAs independently applying rules to limit who can participate on the web” for the particular jurisdiction. > Because other jurisdictions are not protected anyway, it is a too big challenge, right? > Eduard > From: Ted Hardie <ted.ietf@xxxxxxxxx<mailto:ted.ietf@xxxxxxxxx>> > Sent: Tuesday, August 13, 2024 12:35 > To: Vasilenko Eduard <vasilenko.eduard@xxxxxxxxxx<mailto:vasilenko.eduard@xxxxxxxxxx>> > Cc: Nick Lockheart <lists@xxxxxxxxxxxxxx<mailto:lists@xxxxxxxxxxxxxx>> ; ietf@xxxxxxxx<mailto:ietf@xxxxxxxx> > Subject: Re: TLS Everywhere > > Hi Eduard, > > On Tue, Aug 13, 2024 at 9:29 AM Vasilenko Eduard <vasilenko.eduard@xxxxxxxxxx<mailto:vasilenko.eduard@xxxxxxxxxx>> wrote: > Hi Ted, > I am a client of the biggest bank (by all parameters: number of clients, money, whatever) in my country. The US has requested all certificate authorities to ban this bank. They did cancel certificates that have been prepaid for up to 10 years. > > Here is the list of current CA/Browser forum members: https://cabforum.org/about/membership/members/ . As you can see, there are quite a few more than a handful and they stretch across many different national jurisdictions outside the US. There are, however, international sanctions in place that have impacted the issuing of certificates (https://dig.watch/updates/russia-creates-its-own-tls-certificate-authority-to-bypass-sanctions). Is this the situation you are describing? > > I have manually installed the root certificate in the firefox to access the bank. The majority of people (tens of millions) did follow the advice to use a locally developed browser that has a proper certificate pre-installed. > Is it a proper example? For all CAs. > > Nick's message called the use of Certificate Authorities "a backdoor to Internet censorship", but government-mandated sanctions are a bit different than the CAs independently applying rules to limit who can participate on the web. > > regards, > > Ted Hardie > > > > Eduard > From: Ted Hardie <ted.ietf@xxxxxxxxx<mailto:ted.ietf@xxxxxxxxx>> > Sent: Tuesday, August 13, 2024 10:28 > To: Nick Lockheart <lists@xxxxxxxxxxxxxx<mailto:lists@xxxxxxxxxxxxxx>> > Cc: ietf@xxxxxxxx<mailto:ietf@xxxxxxxx> > Subject: Re: TLS Everywhere > > Hi Nick, > > It sounds like you don't have a problem with TLS, but do have a concern that the CA/Browser forum's choices might limit the number of websites that are able to use TLS. First, can you indicate any specific CAs which have sought approval and been denied? Specifically are there any that met the baseline requirements (https://cabforum.org/working-groups/server/baseline-requirements/) and were denied? Have you talked to the CA/Browser forum about this topic? > > Second, you mention Let's Encrypt and note it doesn't solve the problem. Acme is meant to lower the administrative burden for getting and using TLS certificates and it has been an enormous success, in part because Let's Encrypt lowered the cost associated with getting a certificate to zero. The costs of a CA were formerly one of the most serious barriers to deployment. Having one of the available CAs be both free and easy to configure certainly seems to contribute to an Internet that is both open to all and secure for anyone who cares to press the right buttons. Let's Encrypt is not so much a gatekeeper as a helpful friend holding the door for you. > > Third, your call to action is this: > > In order for the Internet to remain free and open, we need a system > where websites can use TLS security, and have their pages load in all > major browsers, **without** needing any permission from a TLS > Gatekeeper. > > TLS security requires authentication and PKIs are mostly the way that authentication is delivered. If you want to propose other authentication methods or adopt other authentication methods, I think you'd need to have some evidence that those methods provide equivalent security and are easier to use. Andy has mentioned DANE/TLS-A as an alternative; while it is a possible route away from CAs, it can be daunting to configure and a wholesale switch to it seems unlikely. Do you have an actual alternative to CAs to propose? > > As full disclosure, I was one of the first chairs of ACME and my company (and specifically my group) supports the work of ISRG/Let's Encrypt financially. > > regards, > > Ted Hardie > > On Mon, Aug 12, 2024 at 8:21 PM Nick Lockheart <lists@xxxxxxxxxxxxxx<mailto:lists@xxxxxxxxxxxxxx>> wrote: > > I'm very concerned about the move to "TLS Everywhere". Not because I am > opposed to TLS security, but because of how TLS is currently > implemented in major browsers. > > The Internet is supposed to be open for all. And historically, it has > been. Anyone can create a website and post it online, and there aren't > any gatekeepers. > > The problem with TLS, however, is that all major browsers will block > your website unless you have a certificate signed by one of a small > handful of "Chosen Few" Certificate Authorities that are hard-coded > into the browser. > > This effectively means that in order to add TLS to your website, you > need permission from a very small handful of approved people. > > This makes the TLS/HTTP2 Internet almost like an app store. You can't > run an app on an iPhone without Apple's permission, and you won't be > able to have a website that isn't blocked, unless you get a signature > from Verisign, Comodo, or "Let's Encrypt". > > Let's Encrypt doesn't solve this problem. It's free to put an app in > the Apple app store, too. > > It's the permissions, or the gate-keeping, that is the issue. > > In order for the Internet to remain free and open, we need a system > where websites can use TLS security, and have their pages load in all > major browsers, **without** needing any permission from a TLS > Gatekeeper. > > In short, the current TLS system, as implemented, is a backdoor to > Internet censorship. We need to come together and find a better way.
Attachment:
signature.asc
Description: OpenPGP digital signature
