[HN Gopher] Being able to partially distrust a Certificate Autho...
       ___________________________________________________________________
        
       Being able to partially distrust a Certificate Authority is good
        
       Author : zdw
       Score  : 40 points
       Date   : 2022-12-07 05:08 UTC (17 hours ago)
        
 (HTM) web link (utcc.utoronto.ca)
 (TXT) w3m dump (utcc.utoronto.ca)
        
       | jwilk wrote:
       | The previous article discussed on HN:
       | 
       | https://news.ycombinator.com/item?id=33876949 (> 100 comments)
        
       | philipwhiuk wrote:
       | It would be good to be able to only trust CAs with some TLDs.
       | That would limit the harm for adding a geographically useful CA
       | to only a certain segment of the internet.
        
         | notanote wrote:
         | The ability exists. Such constraints aren't used very often for
         | root certificates though, as far as I can tell. The Japanese
         | Government CA which was mentioned in the discussions around
         | TrustCor was constrained to .go.jp.
        
           | angry_octet wrote:
           | It needs to be supported in the clients, both browsers and
           | libraries. I'm actually mad that scope restrictions are not
           | more commonly used, and that tooling is absurdly complicated.
           | 
           | It would be useful for internal CAs too, because they could
           | be trusted for only a specific subdomain, eg
           | *.intranet.acme.com.
        
         | thatcks wrote:
         | One of the problems with domain restrictions on CAs is that
         | real world geography has turned out to not correlate with
         | domain name 'geography' for general use. Organizations located
         | in a country (or the EU or etc) will register their domains all
         | over, instead of nicely restricting themselves to something
         | under a single TLD or a small number of them, where they could
         | use a restricted-scope CA. This mostly leaves you with
         | organizational CAs, such as government ones (for the
         | government's sites), and they seem to not have been too popular
         | in practice.
        
       | andrejguran wrote:
       | In theory Firefox in the linked thread did exactly that: They
       | said TrustCor has X number of days to reply to allegations. It
       | sounds like you're proposing a technical solution to a offline
       | solution that already exist.
        
         | jefftk wrote:
         | Chris is explaining why the way browsers currently handle this
         | problem is good, not proposing they act differently.
         | 
         | He did propose that _Linux_ act differently (https://utcc.utoro
         | nto.ca/~cks/space/blog/linux/CARootStoreTr...), and this post
         | is a follow-up explaining the value browsers get out of this
         | partial-trust situation.
        
           | hkdjkfjhfkfjgh wrote:
           | but everyone disagrees.
           | 
           | a sketchy CA should not be given the benefit of the doubt.
           | and customers of sketchy CA should suffer for not doing their
           | homework and should rightly scramble to secure certs from
           | other providers to resume their business.
           | 
           | the only sin of kernel/distro maintainers is not dropping
           | those CAs faster.
           | 
           | what browsers did is the ultimate sin of sacrificing users to
           | not be blamed by something they are fixing under the guise of
           | backward compatibility.
        
       ___________________________________________________________________
       (page generated 2022-12-07 23:02 UTC)