The point I am making is that users understand branding. Their understanding of branding gives them information that they can use. You're right to point out that that will use this branding info in different ways.
In this case, they can use the information to understand the risks. We're not asking anyone to "choose a CA". Instead, we're asking the users to a) choose to avoid CAs and merchants where the CAs have a bad rep,
I am highly sceptical that we can ever raise a user's CA branding awareness and security awareness to a point where they will choose not to shop with their preferred retailer when they otherwise would, merely because of the CA that retailer has chosen.
Earlier, you pointed out the branding success of Intel. Intel has had correctness scares in the past over bugs in Pentiums, and privacy scares over things like chip ID; however, no-one goes into an Internet cafe and demands an AMD computer because an Intel chip might get calculations wrong on their machine and corrupt their email, or might send copies of it to Intel.
and also to notice when a CA changes. If a CA changes, that's a signal that they may be being spoofed.
It's also a signal that the merchant concerned has heard of problems with their original CA and switched.
Therefore, a "good thing" (merchants switching CAs), as defined by this strategy, has almost exactly the same UI effect as a "bad thing" (spoofing). This is deeply concerning.
Fundamentally, when we had no market share, we had no leverage. When we have some, we'll have some. So how about this for an idea to kick around:
- CA Foo issues a bunch of duff certs to phishers
- People lose money
- The MF decides, pragmatically, that CA Foo has sold too many certs to yank their root cert, due to user inconvenience.
- The MF instead declares that CA Foo's root cert will be yanked in 6 months, unless they clean up their act, and that sites should not rely on CA Foo's certs working in 15% of browsers 12 months from now.
- The resultant storm of publicity and uncertainty and doubt causes CA Foo registrations to drop, and CA Foo to clean up their act, and beg us to issue a joint press release to that effect.
It might work...
Sure, something like that.
Note that this plan doesn't require and end user action, or CA names in chrome.
Gerv _______________________________________________ mozilla-crypto mailing list [email protected] http://mail.mozilla.org/listinfo/mozilla-crypto
