Comment by EdHominem | Hacker News Reader

Comment by EdHominem | Hacker News Reader

Parent Full thread

> How would your hypothetical New York attorney with an appliance in a safe validate control over the example.com name?

By letting it connect to the internet and check for its challenge number on the target site.

Also, I'm not imagining lawyers, but all notaries. I actually think a 7-11 clerk could handle the job.

> All of them today require the CA/B Baseline Requirements plus whatever else takes their fancy. Issuing these certificates violates the Baseline Requirements, because the subscriber did not in fact have control of example.com, and probably not of these testN.com domains either

Sorry, I missed the story about the bonded guy losing his million-dollar bond and not ever being allowed to have a similar job. They are bonded, right? Because if not all the yada yada is worthless.

> This is the Internet, nobody cares that you've shown some balding guy who works above a liquor store a fake driving license in the name Bob Smith

This is actually a large deterrent. Because of the notary actually checking ID you know you've got a picture of the bad guy. This is the part where we stop the attack from scaling.

> - we need to know if you're really ycombinator.com or hsbc.com.hk or a-eon.biz and so the BRs require that Certificate Authorities have an effective way to validate that.

Some things you say sound like you work in the industry, and some don't. Please describe the complicated cryptographic process you think a CA employee uses to personally verify ownership of a domain...

Such an appliance, able to make a determination regardless of its environment, does not and cannot exist. That's why our trust is in the humans, either individually (as in your system, no-one does this today) or as a corporate entity (that's how all the public CAs in existence today function).

And those corporate entities (e.g. in this case the multi-billion dollar public company Symantec) are what's on the line when it comes to trust store sanctions. That's why Diginotar no longer exists, even though the Dutch Government tried to rescue it. (Side note: The person who originally started Diginotar was a notary...) and it's why StartCom / WoSign are probably screwed although they're limping along in the Chinese market for now.

I have no idea why you think that seeing a fake ID helps "stop the attack from scaling". You don't have a photo of "the bad guy", you have a photo of somebody who did what they were asked for $20 and a packet of smokes.

And again, validation is not a job for one individual, imaginary million dollar bonds don't make that any less true. Usually domain validation is automated, with the automation overseen by a group of employees, but even where it is not there will be pair reviews or group reviews so that no single person can bypass the system.

Creating the right policies and enforcing them becomes a job for management, for company directors, and where appropriate for the shareholders. A CA must hire auditors to examine these processes. And the audits are reviewed by trust stores. The audits give us confidence that each CA has suitable policies in place to obey the BRs. I would like to see the auditors work directly for the trust stores, but the situation we have today is able to be effective.

For example in the case of WoSign Mozilla told the auditing parent company - EY which used to be named Ernst & Young, a Big Four professional services company - that the branch used (EY Hong Kong) would no longer be accepted as an auditor by Mozilla because based on the available evidence its auditors either had colluded with WoSign / its CEO Richard Wang or were incompetent.

> I have no idea why you think that seeing a fake ID helps "stop the attack from scaling". You don't have a photo of "the bad guy", you have a photo of somebody who did what they were asked for $20 and a packet of smokes.

Yes, and does talking to hobos scale? Can you do that online? Wouldn't they rat you out? Don't they lounge in front of shops that would have cameras?

And if you decide to go through all this, why not ask them to receive money-transfers or something more profitable?

> And again, validation is not a job for one individual, imaginary million dollar bonds don't make that any less true.

No, validation isn't performed by the bond - the bond just gives the employee motivation to do their job. And a disincentive for selling out.

> Usually domain validation is automated

> Such an appliance, able to make a determination regardless of its environment, does not and cannot exist.

Yeah. I totally agree with one of your statements.

The CA system with shared authority over one big zone just can't provide a high level of assurance. The games we play to try to keep Chinese CAs from signing certs for our domains (pinning, etc) are ridiculous. People who try that are playing with fire, and all to avoid issues from the broken model.

The issue is that the CA system is fundamentally flawed. It'll never be that good so trying is like gilding a pig. It's good enough for the sort of system I'm describing, but the things you discuss are so over the top for a fundamentally flawed system. Which is why no CA really takes it seriously - they know they're just collecting rent. In the current system we'll either kill the CAs one after another as someone tricks them into creating certs they shouldn't, or we'll end up with a collection of losers we can't kill because we know the next ones would be just as incompetent. Much like the banks.

What we need to do is adjust our expectations to what we can actually deliver, and are willing to pay for. All we need is a small roadblock you can't accomplish online and certificate transparency to make sure you see everything the system signs.

Reply on news.ycombinator.com