Hacker News new | ask | show | jobs
by agwa 134 days ago
Google Chrome (along with Mozilla, and eventually the other root stores) distrusted Symantec, despite being the largest CA at the time and frequently called "too big to fail".
2 comments

Given how ubiquitous LE is, I think people will switch browsers first. non-chrome browsers based on chrome are plenty as well, they can choose to trust LE despite Chrome's choices. Plus, they had a good reason with Symantec, a good reason to distrust them that is. This is just them flexing, there is no real reason to distrust LE, non-web-pki does not reduce security.
GP gave a very good reason that non-web-PKI reduces security, you just refused to accept it. Anybody who has read any CA forum threads over the past two years is familiar with how big of a policy hole mixed-use-certificates are when dealing with revocation timelines and misissuance.
"it's complicated" is not the same as "it's insecure". Google feels like removing this complexity improves security for web-pki. Improving security is not the same as saying something is insecure. Raising security for web-pki is not the same as caliming non-web-pki usage is insecure or is degrading security expectations of web-pki users. It's just google railroading things because they can. You can improve security by also letting Google decide and control everything, they have the capability and manpower. But we don't want that either.
> non-web-PKI reduces security

How exactly?

There was no good reason given only a "trust me bro".
Half the web didn't rely on Symantec for free certificates. They do rely on LE.
If LE is distrusted, we all stop using TLS and go back to letting the NSA read everything. LE is the only reason HTTPS is now ubiquitous.
Isn't that a really, really juicy target though?
LetsEncrypt doesn't see your private key when you obtain the certificate. So no, it's not _really_ a juicy target.
On the other hand, who's gong to notice a LE issued cert that they did not request in the certificate transparency logs?
The ones who monitor their domains in the CT log.

(Mom-and-pop-stores probably won’t. Other orgs might.)

Why not just stop using Chrome and start using any of the Chrome-based alternatives in instead?
Are you talking about as a user or a website operator?
Neither, I meant if enough people panic and stop using chrome, website operators need not worry much. Safari is default on macs, and Edge is default on windows, both can render any website that can't be accessed in Chrome, so it'll make Chrome the browser that can't open half of the websites, instead of half of the websites out there suddenly being incompatible with chrome. The power of numbers is on LE's side.