Hacker News Reader

Comment by jqm | Hacker News Reader

Maybe people shouldn't sell cell phones to drug dealers.

But what Geotrust did was suspend all cell phones for a certain block of people. In my case, this caused me extra effort and is black mark on clients trust for me. This might be like disabling every minorities cell phone which they legitimately paid for because some minorities used the phones to arrange drug deals. It truly is ridiculous.

How about phone sellers just sell phones? We have other agencies tasked with catching drug dealers.

Never mind I was able to get a new cert from Commodo and was back in action anyway so at most they have annoyed and inconvenienced some folks.

View on HN

I understand, and I'm not defending them. But the comment I originally replied to was going too far in the opposite direction, and saying CAs should never intercede.

Maybe people shouldn't sell cell phones to drug dealers.

There's no easy way to implement such a policy. There's an easy way to implement a policy of "revoke blatantly criminal websites that get reported to us".

CAs should never intercede without a court order. That's how societies determine what is illegal: we let judges and courts sort it out. Otherwise you're making CAs ad-hoc courts which is a bad thing to do. It provides excuses to refuse to issue certificates based on how they feel.

If a site is "blatantly criminal" then it should be an easy thing to get a court to agree and issue an action against them.

I'm surprised that CA guidelines even allow CAs to take website content into issuing procedures.

>CAs should never intercede without a court order.

Are you proposing a law to ban this? Would this apply to any company deciding not to do business with a customer for legal reasons?

>It provides excuses to refuse to issue certificates based on how they feel.

A CA is perfectly within its rights to do that, though! As far as I know, no law obligates CAs to serve everyone.

Nothing to do with law. CAs are bound by the requirements that Mozilla, MS, Google and others set out. These requirements obviously go far beyond the law. For instance they require that a CA issue certs to the public (IIRC), so you can't become a trusted CA if you're only issuing for your company.

I'm not sure why you are trying to turn this into legal issue for companies. Of course they can do whatever they want. But then Mozilla and others should respond by revoking trust.

Specifically, no trusted CA should be revoking or refusing certs on non-identity issues. That seems like a perfectly reasonable requirement to hold CAs to as part of including them in default trust stores.

Reply on news.ycombinator.com