Hacker News new | past | comments | ask | show | jobs | submit login

Rather than persuading CAs to implement Certificate Transparency, how about sorting CAs into groups by jurisdiction and displaying different icons or colors for low/medium/high security, corresponding to having signatures from 1, 3, or 5 complementary jurisdictions? This would give CAs a financial incentive to cooperate: people are less likely to buy 3 or 5 certs at full price, so they could capture significantly more market-share by teaming up and offering to sign each other's customers for half or quarter price. It's (more) free money for them and it significantly complicates the process of performing a MITM, especially if you aren't the USA.

EDIT: Nevermind, I think I understand why it wouldn't work: independently verifying customers is hard, so they would either have to trust each other or spend a nontrivial amount of money verifying each customer. If they trusted each other, the additional security would be worthless, since the host country of the principal CA could just order them to lie. If they each verified the customer independently, they would each incur the usual amount of fixed cost, so they couldn't offer much of a discount.




TACK works without coordination between the 1/2-time TLS maintainer at a browser and the (elaborate) UX/UI team at that browser; it's something you can implement in the backend.

The UX for certificate trust on the Internet is dreadful and essentially hasn't evolved since the late 1990s. It is badly due for an overhaul. But we can get TACK working today; UX changes could take years.


Well since 1990s we at least got EV, which is something.


EV was an exercise in money making, not security.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: