[II2II]

Tangentially related:

The system is deeply flawed, which is something I realized fifteen years ago when I was put into a situation where I had to use online banking. (Had to being the nearest branch of any bank was an hour long flight away, though there was an ice road you could use in the winter.) One of my first questions of the bank was: who issued their certificate. They didn't have a clue what I was talking about. I suppose I could have pushed the question until I found someone who did know, but I also realized that a random person asking about security would be flagged as suspicious. The whole process was based upon blind trust. Not just trust in the browser vendors to limit themselves to reputable CA, but of the CAs themselves and their procedures/policies, and who knows what else.

[JumpCrisscross]

> One of my first questions of the bank was: who issued their certificate

…what did the certificate say?

> whole process was based upon blind trust

If I offer someone a ride and they start quizzing me on what differential I’m driving, I’m going to ignore them. That isn’t requiring blind trust, it’s just the wrong place and way to get the information you’re asking for.

[salawat]

The problem with that analogy is that the cert issuer isn't a mere component of the car, but the entire car in this instance. That cert being trustworthy is the entire point.

When I was in schooling getting filled in on Web of Trust, I about ground that particular day's class to a halt because I couldn't imagine the world was that cavalier on such a thing.

Lo and behold, I realized shortly afterward it absolutely was the case, and there was nada I could do to change it except figure out how to get normal people universally fluent and invested in basic cryptography so they could manage their own trust networks. You can imagine how well that's gone.

[JumpCrisscross]

> problem with that analogy is that the cert issuer isn't a mere component of the car, but the entire car in this instance

I'm critising OP for castiglating a bank employee for not knowing who their CA is. That's not something a line employee needs to know. And that's not the appropriate way to ask that.

If I want to know who issued HN's certificate, I don't e-mail a YC associate. I look at my browser and see it's Let's Encrypt.

[echoangle]

How does knowing the issuer of the certificate tell you anything if any CA can make certificates for your bank domain? If the answer was „sure, we use GlobalSign“, is that good or bad? If the Brazilian CA is malicious, they can still MITM you, right?

(Assuming certificate pinning doesn’t exist, which was the case 10 years ago and is true now, too)

[II2II]

If my bank uses "GlobalSign" and my browser says "Brazilian CA", I know something is wrong. Granted, such a discrepancy would have been more noticeable back then since the lock icon had the issuer displayed next to it. Now I have to click the lock, then select a menu item to get that information. And, if I'm feeling particularly paranoid, it takes 5 clicks to review the certificate. (At least in Firefox.)

If the bank is unable to tell me which CA they use through a trusted channel, the only way I could tell if there is a problem is if the CA changes.

[throwaway2037]

First, you don't tell us the location. Are we talking about a CA in Syria or Canada? It makes a big difference. <sacasm>Second, yeah, I'm sure banking regulators say nothing to commercial banks about using a reputable CA.</sacasm>