Hacker News Reader

Hacker News

Comment by divbzero | Hacker News Reader

Full thread

divbzero

Is there a list somewhere of trustworthy CAs?

Something akin to lists of recommended TLS versions and cipher suites? [1][2]

[1]: https://wiki.mozilla.org/Security/Server_Side_TLS

[2]: https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Shee...

View on HN

You can and should operate your own root trust programme, or club together with other people who have the same idea of what constitutes trustworthy. If, like most of us, you prefer to delegate this problem to your OS vendor then you get to keep both halves when it breaks.

The main trust stores today are operated by Microsoft (for Windows), Apple (for Mac OS and iOS), Mozilla (Firefox and all the Free Unix systems), Google (Android), and Oracle (Java). Smaller or less frequently updated stores are operated by a large number of organisations, including Sony, Nintendo, Avaya, IBM and so on.

All the big stores either explicitly publish a list of what's trusted or provide an obvious way to work it out and some third party aggregates the results.

Most of the trust programmes are completely opaque and proprietary. Mozilla's is open to the public as you'd expect, Google openly relies on Mozilla's process although it takes its own final decisions. Microsoft uses the shared CCADB with Mozilla but doesn't publicly talk about its trust processes.

https://ccadb-public.secure.force.com/mozilla/CACertificates...

Yes, there are a few lists. According to Microsoft, it's the one they embed in Windows, Edge, etc. According to the Chrome team, it's the one in their store. According to Debian, it's the one in Mozilla's CA bundle, etc.

That's true for a relatively low bar, not really equivalent to a list of "recommended" ciphers. The equivalent is probably the 15 CAs with >0.1% marketshare plus a few more particularly well-run ones.

The irony is, these companies that operate trust lists accept zero responsibility in the case you are defrauded using a certificate issued by a CA they deem trustworthy.

Why is that ironic? How much do you pay for access to Mozilla’s trust store?

You are of course free to maintain your own list and not use the lists they provide for free if this is your concern.

I don't think that fraudulent behavior by site operators is relevant to the X.509 certificate system.

All that the certificates do is make it possible to ensure you are talking to the server at the address you intend to communicate with.

TLS has nothing to do with the morality, ethics or legality of the site operator.

It's too bad that the English word "trust" has so many meanings that people get confused about what it means in this context.

Aha! I think's one of the major issues here!

You mentioned TLS versions and cipher suites. TLS is documented in a set of RFCs, so if you want to answer the question "Does software X implement TLS version 1.2?", then you can answer that question by checking its behavior against RFC 5246.

As far as I'm aware, there is no RFC which quantifies trust.

Reply on news.ycombinator.com