Re: Number of CAs (was: Mandatory encryption as part of HTTP2)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, Nov 16, 2013 at 03:11:34PM -0500, Phillip Hallam-Baker wrote:
> But as is well known, many CAs own multiple embedded roots, typically three
> or four brands per large CA and each brand often has several roots. The
> conclusion that the EFF has been peddling is that there are 600 parties
> that can introduce spurious certs, this is not what their evidence
> demonstrates.
> 
> My point was that like the 'Gore claimed to invent internet meme' this has
> become a zombie lie that is repeated by people despite the fact that it has
> been repeatedly shown to be false. People like to believe it because it
> reinforces their prejudices but that does not make it true.
> 
> We should not be making policy decisions on the basis of zombie lies.

Whether the number is 100, or 600, or a thousand (and note that even
if there are dozens or even hundreds of CA's being run by one
"organization", those CA's may be run by different personnel, and have
different policies, and have their certificate signing keys stored in
different ways (i.e., some may be stored on some minimum wage worker's
laptop; others may be stored in some Tempest Shielded fancy-shamancy
BBN secure signing box requiring multiple crypto ignitition keys
before certificates can be issued) --- how you count the CA's or
organizations I don't think is really all that important.  Even if
it's only 100 organizations, or even 50, do you really believe they
can all be trusted, and are you willing to assert that they will all
never having any process or technological failures?

And if you believe that all dozen, or 50, or 100 certificate
organizations can be considered trustworthy, care to explain some of
the more spectacular failures (i.e., Comodo, Diginotar, etc.)?

Quibbling over numbers doesn't change the the fundamental premise,
which is that the certificate signing architecture for the web is
considered by some (including myself), to be pretty badly broken.

Regards,

							- Ted




[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]