I wasn't intending to get into a broader discussion about the merits of encryption. My initial point was two-fold: First, that there are a lot of different scenarios to consider--too many, in fact. Second, that a "good" cert could be used for any of those bad things, although the use of certs is not necessary in all cases.
Regarding use of the term "bad", what does anyone think about this as an alternative: "furtherance of criminal activity" Granted the term criminal might be a bit subjective, but I can't think of good uses for trojans or botnets or ransomware. And I would hope that CA's would agree that furtherance of criminal activity is an inappropriate use of the PKI system? Thoughts? Original Message From: Ryan Sleevi Sent: Thursday, May 26, 2016 11:44 PM On Thu, May 26, 2016 at 1:58 PM, Phillip Hallam-Baker <[email protected]> wrote: > What has encryption got to do with it? The "bad" raised was unrelated to certificates, publicly trusted or otherwise. As Nick also pointed out, a number of the "bad" is just as accomplish through other means independent of certificates - whether using raw public keys, DANE, etc. That is, the concerns raised were about TLS, not about certificates. ...snip... > Now the problem here is that there are also folk who just want to turn on > encryption and that is all and they don't care about doing online commerce > or banking. They just want to keep their email secret. And that is fine. But > that does not mean that people who only want to do confidentiality should > rip up the infrastructure that is designed to serve a different purpose. It would seem you're suggesting that CAs aren't the right infrastructure to enable the Internet's growth and user's security, which may be true, but would be a surprising statement to make. Otherwise, the choice of the term "rip up" to suggest that, regardless of original intent, the infrastructure may better serve users' and security more by doing something more broadly scoped seems... unnecessary simplistic. Put differently, even if it were true that the goal of the Web PKI was to "prevent bad," it still suffers from the same problem - first, the definition of "bad" posited on this thread is largely related to encryption (first and foremost), and thus orthogonal to certificates, but in several of the remaining cases, the definition of bad is a statement that users have unrealistic expectations about what certificates can/do provide. Ironically, those unrealistic expectations may have been caused by CAs themselves and by their marketing teams. So to address these "bad" uses of certificates, it's necessary as the community to decide whether encryption is bad, whether the 'undesirable' uses of encryption and the desire to prevent such uses is worth the risk to the 'good' uses of encryption and the desire to promote them, and to decide on what the reasonable and realistic expectations of certificates should be. _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
