Why on earth should any CA be getting involved in what a site hosts? They need to validate ownership and stop.
Breach notification in 3..2..1...
Explain why they aren't permanently blacklisted and banned from ever being in the root store for any purpose again???
All the lock icon says is "someone who made a request to the CA controls the other end of the connection". Usually this means you aren't being MITM'd by one of your ISP's or WiFi hotspot's ad insertion proxies. That's about it.
If the CAs start wanting to verify organization software engineering practices and issue different certificates based on the outcome of the audit, that's fine. But that's not my current expectation.
B: Criminal for who? I certainly don't want Geotrust deciding what's allowed. Does that mean they can e.g. block sites donating to Wikileaks?
Uh, no. Plenty of companies already censor certain content without accepting liability for parts that they miss. There is no law preventing a company from not hosting content they find problematic, whether it's illegal or for any other reason. That doesn't give up their protection under DMCA. (CAs wouldn't even need DMCA, because they aren't hosting content or redistributing it).
Similarly, there is no law I know of that would disallow a CA from revoking a cert they issued. Maybe breach of contract, but generally their terms will prohibit illegal activities, so the other side will have breached contract first.
ikeboy 3 minutes ago
> I'm fine with a CA doing that. I'm also fine with them choosing to revoke specific certs after deciding those are clearly illegal. If they are later shown to be legal, then sue the CA for breach of contract or whatever.
> If you were a CA, and people were using your certs for a cp site or trading in stolen credit cards, how would you like being told you couldn't revoke the cert unless some court asked you to?
I'd tell them that I'm not responsible for what my clients do or don't do.
The CA root supply isn't big enough for the Free market to do is job by itself.
If you were a CA, and people were using your certs for a cp site or trading in stolen credit cards, how would you like being told you couldn't revoke the cert unless some court asked you to?
>I'd tell them that I'm not responsible for what my clients do or don't do.
Hm, I wonder how well the media will take that ...
Like you said, it doesn't matter what is legal. Media will have a field day talking about my CA should someone like Ashley Madison be my client. But that's just the beginning.
There will be cases against me because well f#$% me, right? I mean I took steps in case A and was unable tondonsonin case B. It doesn't matter if the case has no merit. If there are enough of them, it still distracts me significantly from my job.
At least that's my perspective. I've never run a CA so I'm sure I don't understand the subtleties but the way I understsnd it, perhaps CAs would be better served to restrict themselves to authentication.
Now, that's not to say that CAs should do nothing. For example, if your own private keys are compromised I can imagine a scenario where you'd move quickly to invalidate everything underneath. But I guess these are technical and security reasons not fear of a media backlash.
That's fine. It's also fine for another CA to analyse the situation and come to a different conclusion.
It's not a practical solution, because there are many reasons a supplier might not want a particular piece of business, some of which are not harmful (lack of resources, customer with dubious credit, etc). But the arrogance of prejudging the law is very dangerous to free expression, especially when the vendor is a monopolist or oligopolist, as is the case with CAs. That danger is multiplied further when the scope of the judgment is widened beyond whether the vendor's (always overly conservative) lawyers suggest the company might be liable as a criminal accomplice if it accepted the business. It's becoming quite common for corporations to refuse to serve any customer, or to employ any person, that is not 100% inoffensive to 100% of the population. The slightest hint of controversy or any public (or often, sadly, private) statement that falls outside the Overton Window will result in being cut off. If you ask a corporate lawyer whether serving a particular customer is risky, you will always be told yes, no matter who it is. So allowing their involvement in that decision is problematic, regardless of the nominal reason offered for turning away business.
I don't know whether that's what happened here, because we don't have any kind of announcement, just an anecdote and some supposition. But I would be willing to take some pretty strong measures to make sure it can't. Extending common-carrier status to CAs would be a very modest and narrow place to start, but I would take this much farther, to the very outer edge of what's practical. The world is a horribly stifling place as it is; we don't need corporations contributing to the problem, especially since they are ill-equipped to determine whether something is illegal and will invariably default to the most conservative position.
There are hundreds of CAs. It's one of the least monopolist businesses in that regard.
As to your other points, have you seen http://slatestarcodex.com/2015/07/22/freedom-on-the-centrali...? It makes a similar point IMO.
As for how many CAs there are, it's certainly true that there are zero barriers to entry. All you need is some open source software and a couple of shell scripts. But in order to be an effective CA, you need all the major browser and OS vendors (at a minimum) to ship your root certificate in a trusted-by-default configuration. Otherwise almost no one is going to have their certificates issued by you. Looking at the list of CAs trusted by Firefox and Apple, to name but two, there aren't really that many. A couple dozen, of which many are governmental entities that don't serve the general public. I'm sure if I looked at Microsoft's and Red Hat's and Google's I would find the intersection dwindling to the same old handful we've been stuck with for years.
If it were really that simple to be an effective CA, there would be thousands of them, including many that might not even charge a fee as long as you're a member of a particular club, or that would be explicit about providing an authentication-only service. But there aren't, and that takes us back to the same problem.
But what Geotrust did was suspend all cell phones for a certain block of people. In my case, this caused me extra effort and is black mark on clients trust for me. This might be like disabling every minorities cell phone which they legitimately paid for because some minorities used the phones to arrange drug deals. It truly is ridiculous.
How about phone sellers just sell phones? We have other agencies tasked with catching drug dealers.
Never mind I was able to get a new cert from Commodo and was back in action anyway so at most they have annoyed and inconvenienced some folks.
Maybe people shouldn't sell cell phones to drug dealers.
There's no easy way to implement such a policy. There's an easy way to implement a policy of "revoke blatantly criminal websites that get reported to us".
If a site is "blatantly criminal" then it should be an easy thing to get a court to agree and issue an action against them.
I'm surprised that CA guidelines even allow CAs to take website content into issuing procedures.
Are you proposing a law to ban this? Would this apply to any company deciding not to do business with a customer for legal reasons?
>It provides excuses to refuse to issue certificates based on how they feel.
A CA is perfectly within its rights to do that, though! As far as I know, no law obligates CAs to serve everyone.
I'm not sure why you are trying to turn this into legal issue for companies. Of course they can do whatever they want. But then Mozilla and others should respond by revoking trust.
Specifically, no trusted CA should be revoking or refusing certs on non-identity issues. That seems like a perfectly reasonable requirement to hold CAs to as part of including them in default trust stores.
Because they don't want to do business with a criminal.
I don't either, most of the time. But verifying a certificate is the equivalent of checking someone's ID to make sure the name matches the face. It doesn't tell me whether someone is a criminal, nor do I expect it to. If it's that important to me, I'll check their ID and then head to the county courthouse to check public records before agreeing to anything. Whether someone is a criminal, what kind of criminal, and how recently are both too much data and too perishable and uncertain to put on someone's ID card. Which is why that's not done in most (any?) jurisdictions.
But CAs aren't government entities (well, some are, but that's besides the point). There's no right to get a cert.
This is the equivalent of a private company issuing ID cards, and deciding that they'll stop issuing cards to anyone who uses the cards for illegal activities.
That is the question I am debating. I agree that what was actually done is wrong.
See https://news.ycombinator.com/item?id=10183619, my previous response along these lines.
Nearly all developed Western countries have judicial systems that presuppose innocence until proven otherwise in a competent criminal court following established procedures. It seems like your cultural background is very different from that, which is why we're not communicating well. In my culture, asserting that someone was doing something illegal means that the person has been convicted by a criminal court with respect to that act. In many systems, saying that someone was doing something illegal without either a conviction or bearing witness under oath to the allegedly criminal act is itself a crime, that of slander or libel. It seems that you are using a very different definition, one that I don't understand. While I know little of Palau's legal traditions, in this case both the CA and its customer had no ties to Palau, and their business relationship was not governed by its laws. So even if that country and its legal culture does not follow the same principles as mine, it's not relevant to this case. Perhaps that's the confusion here?
This is a legal presumption of innocence. It doesn't mean the actions are legal.
When I say "illegal", I mean "breaks a law". This has nothing to do with cultures as far as I know; I'm an American citizen.
Whether you can tell if someone broke the law is a different question.
Let me ask you directly: if someone were to rob a bank and never get caught, did they do something illegal? If not, how would you express the claim that they did something against the law?
No conviction, no crime. I could, however, state that the bank was most likely robbed based on nothing more than accounting information. There's a crucial difference between stating that something happened and accusing a specific person of a criminal act.
> If not, how would you express the claim that they did something against the law?
As a witness to an act, I would state the facts as I observed them, without passing judgment myself. This is exactly what's done in court. "At time X I was at location Y, and I saw a person with features Z enter the bank, pass a piece of paper to a teller, and run out of the bank shortly thereafter with what appeared to be cash. I believe that person to be the defendant, who is sitting there (points)." The testimony of non-expert witnesses is limited to facts, not opinions. Because for all I know, the note could have been a valid withdrawal slip, the customer may have been in a hurry, and the money was actually stolen by a teller and an accomplice who used the rushed customer's large withdrawal as a cover (was the customer an accomplice? I don't know!).
If I were not a witness, I wouldn't make such a claim in the first place.
All the more reason that they have no particular responsibility to revoke certificates of "criminals".
We've absolutely got to get rid of the idea that a certificate is any sort of measure of probity. It isn't. It's simply a verification of identity.