Slashdot Mirror
What Would It Take To Have Open CA Authorities?
trainman writes "With the release of Firefox 3, those who have been using self-signed certificates for SSL now face a huge issue — the big, scary warning FF3 issues which is very unintuitive for non-technical users. It seems Firefox is pushing more websites in to the monopolistic arms of companies such as Verisign. For smaller, especially non-profit groups, which will never have issues with domain typo scammers, this adds an extra and difficult-to-swallow cost. Does a service such as this need the same level of scrutiny and cost since all that is being done is verifying domain and certificate match? This extra hand holding adds a tremendous cost and allows monopolistic companies such as Verisign to thrive. Can organizations such as Mozilla not move towards a model that helps break this monopoly, helping establish a CA root authority that's cheap (free?) and only links the certificate to the domain, not actual verification of who owns the domain?"
try it....
First of all, what does this certification crap prevent?
I go to randommalwaresite.com, I get a certificate for randommalwaresite.com!
HURRAY!! Everybody is happy. WTF?
or create your own CA with a link on the http site to install that root cert on the browser.
Godaddy has a very simple SSL cert option that only validates that the certificate issued matches the domain registration info, which is super cheap.
Why is this being brought up now as something new? IE7 has been doing practically the same thing since it was released. I agree that there should be something "open source", but this is far from new...
The fact that there are "compan*ies* such as Verisign" means Verisign is not a monopoly. In Firefox, go to Tools, Options, Advanced, Encryption, View Certificates, Authorities. These are all valid CAs according to Firefox. As for being cheap, a quick check at GoDaddy's says you can get one from them for $30/year.
Don't buy from GoDaddy. There are better and cheaper alternatives.
$14.95 - http://www.rapidsslonline.com/rapidssl-certificates.php
And unlike godaddy that on is not a chained cert.
1984 was not supposed to be an instruction manual.
Can organizations such as Mozilla not move towards a model that helps break this monopoly, helping establish a CA root authority that's cheap (free?) and only links the certificate to the domain, not actual verification of who owns the domain?
How can anyone possibly establish that a given certificate is associated with a given domain without first proving that they do indeed have the (ownership) rights to establish said association?
What you are asking for can be accomplished via SecureDNS, you can enter the hash of the certificate in the DNS entry and Secure DNS ensures that only the authorized party can enter that association and verifies that it was not changed. SecureDNS facilitates a lot of these kinds of authentication issues by extending the rooted hierarchy of DNS names to securely dissiminate information, whether it be IP addresses of servers or public key commitments. See my paper "Layering Public Key Distribution Over Secure DNS using Authenticated Delegation" (ACSAC 2005).
Counterpoint:
I basically run the IT division for our organization. If we purchased for-sale SSL certs it would cost us thousands of dollars per year on something that I can generate, for free, for the various secured services we provide (both internally and externally) for the employees of this organization. There's simply no reason to do so, especially when the reason for the SSL cert is for the sole purpose of encrypting traffic between client and server.
Instead, we use a self-signed CA cert and deploy the public part of the CA cert to all machines that use the services. That way, even Firefox 3.0 doesn't care. I don't see why you couldn't provide a similar service where you could make the site's self-signed CA cert available before signing into the SSL-encrypted part of the site.
They offer certs with domain validation for free. There are gentle attempts to upsell you to higher levels of validation, but their domain validated certificates work without errors. Look here.
If you want certs that are validated to your business' identity (instead of just your domain) and don't indicate in the DN that they were free, there is a small charge.
.sig: file not found
I wasn't willing to shell out $100 (about half my yearly profit!) for the stupid certificate.
It's not quite as bad as all that. Namecheap offers "RapidSSL" for $13 a year. They even have a deal where you can get a free SSL cert with registration or transfer of a domain. Still, yeah, SSL certificates are kind of a racket.
In your case, it's probably appropriate to ask your uses to add CACert or a self-signed certificate to their browsers. This isn't rocket science.
Conformity is the jailer of freedom and enemy of growth. -JFK
My mother is a non-technical firefox user. Meaning, I got tired of cleaning up her machine, so I installed firefox, put the little IE icon on her desktop to link to the FF executable, and have had much fewer reasons to go over and "clean up her computer."
I wasn't involved in the auditing process when the company I worked for started it's CA, but I believe that assessor is WebTrust. The fees are... significant; as are the physical and technical security requirements.
CA signed certificates aren't quite a license to print money, but almost.
Complying with SOX, PKI, and PCI security requirements all at the same time was an interesting experience.
Yes, I am a smart ass; it's better than the alternative.
where i work we purchased a wildcard certificate (*.domain.com) from netsolssl.com for 419$.
while id like it to give us the ability to sign our own cert from it, limited by the CN component, right now we just deploy the same cert to our different servers (admitedly for a bit more risk, but still very low considering our overall exposure)
Get a wildcard certificate or a UCC. UCCs let you have multiple hostnames on the same domain, and they aren't so expensive.
http://en.wikipedia.org/wiki/GoDaddy#Controversies
This is to say nothing of a number of lower profile controversies and the fact that their entire site is a usability nightmare that seems largely designed to trick marginally informed customers into buying (and cause more savvy customers to explode in frustration).
Tweet, tweet.
It looks like someone has already started the process for Firefox, at least.
"He may look like an idiot, and talk like an idiot, but don't let that fool you. He really is an idiot." - Duck Soup
IE7 is worse, because its user interface does not ask the user if they want to add the site as an exception as Firefox 3 does. The end result is you get the big, scary warning in IE7 every time you visit the site, but you get it only once in Firefox 3 because you need to add the exception before it will let you proceed to the site.
Anyway, get a free cert from StartSSL and the problem is solved.
What a fool believes, he sees, no wise man has the power to reason away.
I'm sure you do. Irrelevant.
>> Again, FF's fault how?
Its not - it has to do with root CAs...like the title of my post implies (let me clarify) [Firefox is] "Not the first one..." [Google Checkout does this too]
>> It's not like it's impossible to accept a self-signed cert, and for all the "scripting" you've done, why don't you mention a quick blurb about FF3's advanced certificate security and validation mechanisms and how a user might go about accepting your self-signed cert.
I agree. Not impossible. It's a source of confusion for those who don't understand, and a just pain in the ass for those who do. And 99% of the time, your not securing financial transactions, your encrypting pages on the bug tracking database at work, or something mundane.
That's pure nonsense. No CA ever paid a dime to the Mozilla Foundation or Mozilla Corporation (as opposed to the days of Netscape). Poke around http://groups.google.com/group/mozilla.dev.tech.crypto/topics to get a clue about how Mozilla handles inclusion of CAs.
I don't see them in my CA collection that shipped with Firefox 3.0.1pre. What's their browser coverage?