Hacker News Reader

Comment by tptacek | Hacker News Reader

eMudhra is (was?) a global CA and had subsidiaries serving the US market. Your browser also doesn't have a nationalist configuration; the same browser serves people all over the world.

The problem isn't foreign companies; it's bad CAs.

View on HN

No, the problem is foreign companies. Foreign nations have interests and as a US citizen I want to only trust other US citizens with my security, so should any other citizen anywhere else e.g. India can rely on India.

So if you want to visit an Indian website, your browser should say "no! US websites only!"?

Russia, China, and North Korea approve!

If this also means blocking Indians from US websites? God yes, please

No, since the law you propose would be a US law, it would only affect people in the US.

And what about when you, as a US citizen, are in India?

I would never want to visit India lol

Millions of non-US citizens (foreign workers in the country and outsource workers) build American software. Too bad :doge:

Is it paranoia, stupidity, or ignorance? I really hope it's the last one. Suggested Google prompt: “How does WebPKI work; explain to a US-citizen ONLY by an US-citizen".

As a US citizen, I don't love this mindset. The US has relatively lax rules around cybersecurity and consumer protection. Some other countries are even worse. Furthermore, I continue to participate in a relatively borderless global Internet. Unconditionally placing identity politics ahead of those realities is a strange and impractical choice for a great many people.

> as a US citizen I want to only trust other US citizens with my security

man fox news has really done a number on people's brains.....

I just had a horrifying vision of a world where we have to purchase separate certificates from local certificate authorities in each country where we want to make a website available. shudder

It would make more sense to make the CAs opt-in. Want to trust CAs for US and IN? Opt-in to both.

You can do that now!

There are good and bad operators everywhere. It's naive to think they follow along nationalistic lines.

> only trust other US citizens with my security

I'm not sure what you mean, but this doesn't seem to be a coherent concept.

I think the point is that it's much easier to sue US companies and other US citizens than it is to sue some Indian company. The latter would require State Department involvement, whereas the former I could probably just do in my local court.

Symantec faced no serious legal repercussions. It was simply distrusted by the root programs, the same way eMudhra will be. I think this is a just-so story.

Legal repercussions would have to come from proven damages, and something like that seems like it would be very hard to prove. I'm not that familiar with the Symantec incident, but yeah, it sounds like the system corrected itself.

No, US companies can sue Indian companies. It doesn't need the state department. U.S. companies have sued Indian companies in Indian courts and won rulings or favorable judgments across various commercial, patent, and trademark disputes.

Famous examples include: Samsonite vs. Indian Competitors like VIP - Samsonite won the case.

Novartis vs. Indian Generic Makers. This went all the way to the Indian supreme court before Novartis lost the case. (And thank heavens for that).

Microsoft and Dell: They have won nearly all their cases in India involving unauthorized software and misuse of trademarks.

These are just the big names. There are dozens of smaller US companies.

I can't believe sibling commenters. As a citizen of country X, it should be easy to sympathize with the desire to only do business with other citizens of country X or businesses registered in country X. Why? Because if they wrong me in some way, then I can sue them in a court of law in country X.

All cross-border business is fundamentally import/export and comes with the same risk - that when I am wronged by someone in another country, I have no legal recourse. The exceptions to this rule (like airlines) are such enormous exceptions that there are literally international treaties (e.g. Montreal Convention) to enable it.

Nothing fundamentally US-centric about that point of view.

You can want a nationalist Internet trust model, and 2027 is an extremely good year to build it, because the major browsers are all malleable.

What you cannot reasonably expect is for the entire Internet to operate on a "these countries good, these countries bad" model, for many reasons, including that the citizens of your preferred countries are wildly outnumbered.

And there is a simple solution: stay off the internet and keep yourself to your national network. There is nobody stopping people from that.

This is a US website with a Let's Encrypt certificate.

Anyone who is not in the US saying, on here, "I do not need CAs that are not my national ones" would realize the problem before even posting.

I'm personally happy to assume the risk of trusting Let's Encrypt in spite of the lack of legal recourse.

Trying to equivocate between Let's Encrypt and eMudhra is crazy, as is trying to argue that they should both be trusted globally by default by everybody. I trust LE because of their track record. I had never heard of eMudhra before this.

The argument is not about who you, personally, are willing to trust. Nor about two specific CAs. It is about the fact that Let's Encrypt, which is US based, is an obvious necessity. As such, anyone not in the US should realize that they need to trust CAs that are outside of their national borders.

> anyone not in the US should realize that they need to trust CAs that are outside of their national borders

You say this, in 2026, when the EU is trying to move to an EU Sovereign Cloud Framework: https://commission.europa.eu/news-and-media/news/sovereign-c...

I have a deep problem with your usage of the word "need". EU citizens can make a free choice (or not) to trust US-based certificate authorities, and US citizens can make a free choice (or not) to trust EU-based certificate authorities. There are certainly many reasons why that should be the case. But in a world where we need to negotiate whether food safety standards in X economic block are sufficient for Y's citizens and vice versa, and this is literally the stuff of trade deals, the idea that US-based certificate authorities should be universally trusted because of little more than historical legacy is not the policy position of people who believe in free markets and free choices.

I think you're both talking past each other. You have a colorably legitimate preference, to (at least by default) trust only security anchors within a limited set of jurisdictions. Fair enough! I think it's clear why that kind of preference can't be a global default for the whole Internet, but you can have it right now just by copying this comment thread into Claude and saying "make my browser work this way". It's buried configuration in all the browsers, but it's configuration. You won't even have to build software.

> only trust other US citizens with my security

Can't use a computer then.

So you'll be getting rid of Firefox, Chrome, Edge, etc.? All of which have non-USCs working on security code in their browsers?

Reply on news.ycombinator.com