Timeline for Can we get rid of CAs with CT?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 26, 2017 at 15:25 | history | edited | Mike Ounsworth | CC BY-SA 3.0 |
added 49 characters in body
|
| Sep 26, 2017 at 15:24 | comment | added | Mike Ounsworth | @Mehrdad Ok, I'll change the wording. But I work for a CA and we all live with the constant fear of losing our jobs overnight if Google and Mozilla decide to pull us, so from our end, it seem pretty sword-of-Damocles-y. | |
| Sep 26, 2017 at 6:11 | comment | added | user541686 | "at the first sign of trouble" might be quite a bit of an exaggeration... | |
| Sep 25, 2017 at 21:31 | history | edited | Mike Ounsworth | CC BY-SA 3.0 |
added 1882 characters in body
|
| Sep 25, 2017 at 20:47 | vote | accept | Simon | ||
| Sep 25, 2017 at 17:11 | history | edited | Mike Ounsworth | CC BY-SA 3.0 |
added 940 characters in body; added 169 characters in body
|
| Sep 25, 2017 at 15:48 | comment | added | Mike Ounsworth | @Simon Yeah I think that's ok, but since the CT logs are doing domain validation, let's stop calling them CT logs, and call them instead "distributed CAs (dCA)". So your browser will only trust an https cert if it was "issued by" (aka in the logs of) multiple dCAs. I think that could work, but would be a fairly major change to the fundamental PKI system. As an example, currently offline devices (or devices with no direct internet access) can pin a root CA cert and still validate signatures on PDFs, code, etc. I don't think your model will allow that easily. | |
| Sep 25, 2017 at 15:29 | comment | added | Simon | But what if the CT log admins are not trustworthy and slip in one that didn't actually pass the verification? - Good point. Can we find a solution to this? CT logs are distributed. Domain owners could submit the cert to at least 3 CT logs, and browsers would validate the cert if it is signed by at least 3 logs? Could that be a solution? | |
| Sep 25, 2017 at 15:02 | history | answered | Mike Ounsworth | CC BY-SA 3.0 |