| ▲ | jwineinger 2 hours ago |
| Do I, as a US-based English speaking person, need to have CAs from India and other places trusted by default in my browsers/devices? My gut says no and it just represents unnecessary risk, but I'm also not fully aware of how interleaved cert issuers are with cross signing and such. |
|
| ▲ | tptacek 2 hours ago | parent | next [-] |
| eMudhra is (was?) a global CA and had subsidiaries serving the US market. Your browser also doesn't have a nationalist configuration; the same browser serves people all over the world. The problem isn't foreign companies; it's bad CAs. |
| |
| ▲ | seki285 2 hours ago | parent [-] | | No, the problem is foreign companies. Foreign nations have interests and as a US citizen I want to only trust other US citizens with my security, so should any other citizen anywhere else e.g. India can rely on India. | | |
| ▲ | solatic an hour ago | parent | next [-] | | I can't believe sibling commenters. As a citizen of country X, it should be easy to sympathize with the desire to only do business with other citizens of country X or businesses registered in country X. Why? Because if they wrong me in some way, then I can sue them in a court of law in country X. All cross-border business is fundamentally import/export and comes with the same risk - that when I am wronged by someone in another country, I have no legal recourse. The exceptions to this rule (like airlines) are such enormous exceptions that there are literally international treaties (e.g. Montreal Convention) to enable it. Nothing fundamentally US-centric about that point of view. | | |
| ▲ | tptacek 5 minutes ago | parent [-] | | You can want a nationalist Internet trust model, and 2027 is an extremely good year to build it, because the major browsers are all malleable. What you cannot reasonably expect is for the entire Internet to operate on a "these countries good, these countries bad" model, for many reasons, including that the citizens of your preferred countries are wildly outnumbered. |
| |
| ▲ | bunderbunder an hour ago | parent | prev | next [-] | | As a US citizen, I don't love this mindset. The US has relatively lax rules around cybersecurity and consumer protection. Some other countries are even worse. Furthermore, I continue to participate in a relatively borderless global Internet. Unconditionally placing identity politics ahead of those realities is a strange and impractical choice for a great many people. | |
| ▲ | rpdillon an hour ago | parent | prev | next [-] | | There are good and bad operators everywhere. It's naive to think they follow along nationalistic lines. > only trust other US citizens with my security I'm not sure what you mean, but this doesn't seem to be a coherent concept. | | |
| ▲ | petcat an hour ago | parent [-] | | I think the point is that it's much easier to sue US companies and other US citizens than it is to sue some Indian company. The latter would require State Department involvement, whereas the former I could probably just do in my local court. | | |
| ▲ | tptacek an hour ago | parent [-] | | Symantec faced no serious legal repercussions. It was simply distrusted by the root programs, the same way eMudhra will be. I think this is a just-so story. | | |
| ▲ | petcat 43 minutes ago | parent [-] | | Legal repercussions would have to come from proven damages, and something like that seems like it would be very hard to prove. I'm not that familiar with the Symantec incident, but yeah, it sounds like the system corrected itself. |
|
|
| |
| ▲ | mintplant an hour ago | parent | prev | next [-] | | I just had a horrifying vision of a world where we have to purchase separate certificates from local certificate authorities in each country where we want to make a website available. shudder | | |
| ▲ | cpburns2009 an hour ago | parent [-] | | It would make more sense to make the CAs opt-in. Want to trust CAs for US and IN? Opt-in to both. | | |
| |
| ▲ | paaloeye an hour ago | parent | prev | next [-] | | Is it paranoia, stupidity, or ignorance? I really hope it's the last one.
Suggested Google prompt: “How does WebPKI work; explain to a US-citizen ONLY by an US-citizen". | |
| ▲ | rascul 23 minutes ago | parent | prev | next [-] | | > only trust other US citizens with my security Can't use a computer then. | |
| ▲ | cvhc an hour ago | parent | prev | next [-] | | Millions of non-US citizens (foreign workers in the country and outsource workers) build American software. Too bad :doge: | |
| ▲ | whynotmaybe an hour ago | parent | prev | next [-] | | And what about when you, as a US citizen, are in India? | |
| ▲ | Vaushite an hour ago | parent | prev | next [-] | | So if you want to visit an Indian website, your browser should say "no! US websites only!"? | | | |
| ▲ | mathisfun123 an hour ago | parent | prev [-] | | > as a US citizen I want to only trust other US citizens with my security man fox news has really done a number on people's brains..... |
|
|
|
| ▲ | jttnr 10 minutes ago | parent | prev | next [-] |
| You are free to manage your local trust store yourself. Either remove the CAs that look fishy to you or, conversely, start with a blank one and add only the ones you personally trust. |
|
| ▲ | paaloeye 2 hours ago | parent | prev | next [-] |
| Very bad argument. WebPKI and the internet are the global infrastructure.
For the sake of argument, what unnecessary risk do you have in mind? |
| |
| ▲ | tuwtuwtuwtuw 22 minutes ago | parent [-] | | He was asking, not putting forward an argument. Trusting a CA that uses 4 as the private key is risky. If it's a small CA that issued certs that you don't need to consume, it would be an unnecessary risk to trust it. |
|
|
| ▲ | cpburns2009 an hour ago | parent | prev | next [-] |
| It's a strange liability that every trusted CA is authorized to sign certificates for every possible domain, even ones it has no right signing. It would make more sense for them to be limited to a set of TLD/ccTLD. |
| |
| ▲ | throwaway7356 11 minutes ago | parent [-] | | > even ones it has no right signing They have that right though? There is no monopoly to single CAs for a given domain. |
|
|
| ▲ | throwaway7356 an hour ago | parent | prev | next [-] |
| If you use the internet, yes. If you want only to connect to the US net, stop connecting to the internet and use a US browser instead of a web browser. |
|
| ▲ | maxnoe an hour ago | parent | prev | next [-] |
| Many US institutions seem to have used eMudhra as a cert provider, including Cornell, and the U of Michigan, Maryland and Chicago. Check InCommon Certificate Service. |
|
| ▲ | darkwi11ow an hour ago | parent | prev | next [-] |
| I wonder if Web, WebPKI and some other global network infrastructure are a sign of the emerging internationalist, stateless order ahead of us. Might be a hot topic on next Joe Rogan show :) |
| |
| ▲ | woodruffw an hour ago | parent [-] | | That would be an awfully slow emergence, given the age of the Web PKI. |
|
|
| ▲ | slig an hour ago | parent | prev | next [-] |
| Makes as much sense as having Chinese or Russian or NK CAs. |
|
| ▲ | tonymet an hour ago | parent | prev | next [-] |
| On windows & Mac OS, I turn off silly-sounding certs in the cert store. You don’t need that many to use your regular apps. |
|
| ▲ | qurren 2 hours ago | parent | prev [-] |
| Until some website of some service you're using embeds an Indian-sourced JavaScript required for its support chat and you're unable to get a refund on a defective product you purchased. Or worse, you were billed incorrectly by some US-based service, their support chat loads Indian assets, and they threaten to hit your credit score and send debt collectors after you if you don't pay up. |
| |
| ▲ | nofunsir an hour ago | parent [-] | | US consumer protection laws do not and CANNOT require US citizens to trust foreign agents. Period. There are other ways to extract a lawful refund. | | |
| ▲ | throwaway7356 an hour ago | parent [-] | | Yes, US customers can rely on the US postal services to deliver US mail. No need to use international services like the internet. |
|
|
