On Thursday, August 16, 2018 at 6:18:47 PM UTC-5, Jakob Bohm wrote: > The main cause of this seems to be that CT has allowed much more > vigorous prosecution of even the smallest mistake. Your argument > is a sensationalist attack on an thoroughly honest industry.
I certainly didn't mean it as an attack. I do agree that CT has allowed for greater scrutiny and in turn we find more issues. Some of those issues are insignificant, some are of concern. I did not mean to in any way imply that there is currently a controversy involving malfeasance at a CA. In fact, my proposal stemmed in equal part from the concern that today's domain validation methods are susceptible to problems in network service layers which are known to be insecure and where vulnerabilities have been demonstrated. > That is a viewpoint promoted almost exclusively by a company that has > way too much power and is the subject of some serious public > prosecution. Cow-towing to that mastodont is not buy-in or agreement, > merely fear. In this particular aspect, I suspect you and I substantially agree. I don't hold any strong opinion against that particular company, but they certainly can bring much weight to any argument they make. I do see both sides of the argument. I'm on the record in several other threads in this group advocating for the value of strong identity in WebPKI certificates and advocating for continued inclusion of this information. My overall position on that has not changed and to reiterate clearly, one again, I'm definitely on the other side of that argument versus that certain large company. Having said that, IF and only IF consensus arrived in the other direction -- that the only meaningful subject identifiers in WebPKI certificates are the covered domain labels -- then I would assert that it makes sense to pursue a WebPKI in which the existing authority hierarchy be directly responsible for certificates within that hierarchy and in a manner constrained directly to the limits of each Registry's authority over the DNS. This, I believe, would be preferable to a multi-party system in which the best practices, at best, determine issuing authority on the basis of insecure proxies and consequences of the authoritative data. _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
