Bonum Certa Men Certa

Transport Layer Security (TLS) is Fine, Centralised Certificate Authorities (CAs) Are Not

Video download link | md5sum b147528fd1ea28881ed4578632fbd8b7 War on Decentralised Internet and Computing Creative Commons Attribution-No Derivative Works 4.0



Summary: There's a lot of misconception/misunderstandings about what the Certificate Authorities (CAs) are, what they're for, how they work, and why they don't actually tackle the biggest security and privacy problems, they're mostly about centralisation of control and outsourcing of "trust" from pertinent sites/services to monopolies, empires, and oligarchs

SOME days ago someone was "[s]houting out to @tuxmachines to check your server. SSL certificate-based error messages are flying..."



This was not unforeseen. A lot of people sadly believe what Web browsers tell them, not bothering to take into account the agenda promoted by such Web browsers. It's about control and centralisation, it's not about security and/or privacy. A "malicious Web site can easily get a TLS certificate from a CA and turn the padlock on your browser green and go ahead and load," DaemonFC reminds us. "And it's still a malicious Web site."

"Let's Encrypt even admits that they do nothing to protect you from a malicious Web site, and suggest reporting those to Google and Microsoft," DaemonFC adds.

"A lot has happened since then, notably Russia's invasion of Ukraine, which resulted in a lot of censorship inside Russia, by Russia, and against Russia."Those who say that getting a 'good' certificate is 'free' may be missing the point. It is like buying a 'secure' boot certificate from Microsoft on the 'cheap' (until the OEMs toss them out). We wrote about this in relation to Certificate Authorities before, with focus on the "big fish", Let's Encrypt [1, 2, 3], or LE.

The video above revisits this subject. A lot has happened since then, notably Russia's invasion of Ukraine, which resulted in a lot of censorship inside Russia, by Russia, and against Russia. Now that the centralised systems are in place, censorship is vastly stronger. Is this security???

A given Gemini address is accessible so long as there's a certificate in place, even a self-signed one (vouching for oneself). The same model ought to have been adopted for the Web. For online banking it would help if banks sent expected fingerprints, e.g. by post. Outsourcing to monopolies isn't the way to go.

"Outsourcing to monopolies isn't the way to go."Readers might correctly spot the resemblance or notice the similarity to UEFI 'secure' boot. First they start with recommendations, saying it is all about security and enhancing safety. And then intimidation, seeking compliance from people who disregard the recommendations. Finally, they resort to outright locking out (blocking) anything that is not submissive, e.g. after 90% or more have already surrendered. So this is a form of blackmail for lock-down, initially marketed as a well-meaning security scheme. They're insincere about motives. Nothing here is "free"...

Right now, after we've witnessed expansion in Web censorship, we believe stronger resistance will be needed by explaining to people what's happening. Remember that this is not about security; it's all about control and one day revoking certificates can be weaponised further and further, just like DNS-level censorship, denial of ClownFlare access, and so on. They typically start with "pirates", "terrorism", and "the children" before resorting to political angles. CAs can very easily and immediately be leveraged for outright censorship.

"Finally, they resort to outright locking out (blocking) anything that is not submissive, e.g. after 90% or more have already surrendered."In the video above I remind people that the Linux Foundation's LE has already revoked millions of cerificates before (without even properly explaining what had happened!) and it'll happen again sooner or later. Maybe at some point they'll just decide to revoke all LE certificates for Russian sites, citing some political "sanctions". Then what? Who's next?

As an associate noted yesterday, "those that control the signing authorities can issue revocations at any time they feel like it and for any reason they feel like..."

In the case of Debian, we recently saw how trademarks get leveraged to censor criticism and hide problems. They just confiscate critics' Web sites. Maybe we'll do a video about this soon, seeing that the debian.community site is now succeeded by debian.day and debian.news. It's a namespace battle in DNS.

DaemonFC concludes: "The only thing that HTTPS does do is help keep what you do to interact with the server private from outsiders, and that is important. But if you fall for a site claiming to be your bank because it has a green padlock, that doesn't help you avoid a scam. One of the reasons I used to promote HTTPS Everywhere to everyone was because I believed the user should have the option to try to force it on with as many sites as possible. But I never would have argued for a system where HTTP is basically deprecated without TLS and browsers try to say there's something wrong with accessing such a Web site if you don't mind your information between your browser and that site remaining private. It's a good "upgrade". It is. It stops things like the Man-In-The-Middle Attacks that Comcast was using in order to spam its customers and inject advertisements into Web pages. So that's why I started using it. I thought it was outrageous that wherever I went, here's Comcast injecting alerts about data usage or ads for their TV package into my Google searches. HTTPS breaking that is a happy side-effect of what it does."

"I was big on the idea of bringing CACert into the certificates package used by Mozilla, but they always found some bullshit reason not to. Like, they didn't even want to talk about it. The whole situation with certificates is a legacy of Netscape. All of the old "players" that are really valuable and "trusted" by just about everything started out that way because Netscape Corporation put them in the Netscape Navigator browser. Then Microsoft came along with their stolen Internet Explorer product (they stiffed Spyglass Mosaic and then didn't pay them) and lobbed all the same certificates in so that sites working in Netscape Navigator would also load in Internet Explorer. And then the tragedy just kept expanding from there. Opera had to throw all the same certificates in because they've never had more than 2% of the browser market. The user has really no control over how this works. It's always been 100% Big Business. From Netscape to Microsoft to Apple and Google."

"Remember when they had that Diginotar CA that was compromised? An entire CA! They had to revoke and remove an entire CA. What a mess that was. Everything in that "chain of trust" was broken and all the sites that used it had to get new certificates, and many Windows and Mac developers got caught with their pants down and had security alerts warning the users not to install the software that the OS was saying "THIS IS FINE!" about yesterday. That was hilarious, and sad. Sad because everyone watched what ensued and nothing was fixed. They revoked one CA and caused all sorts of Hell, but it could happen with any of them."

They still push this very same agenda for software, not only Web sites, various services (including IRC), and booting.

MinceR then said that "PKI as a whole is badly designed."

Recent Techrights' Posts

“Twibel” Actions Against Comedians (and Why It's a Truly Low Blow)
they try to make up in quantities for a lack of merit or quality
Rewriting Things in Rust
How far would you go?
What Microsoft Reputation Laundering (With a Weaponised Law Degree) Looks Like in a Foreign Continent
You would expect this in uncivilised and primitive countries
Slopwatch: LLMs 'Write' Fake or Distorted 'News' About "Linux"
LLM slop disguised as news
 
The Mainstream Media Took 4 Days to Realise Microsoft Shut Down Its Operations in Pakistan and Fired Everybody
We estimate that Microsoft has had about 29,000 layoffs since January
Leadership in Free Software
Don't let IBM lead. It's a terrible flag bearer.
Linux Foundation Apparently Flirting With Slop (Marketing by LLM-Generated SPAM)
The Web is in a really bad state!
COVID-19 Sped Up Site Improvements in Techrights
A few months later we created our very own IRC network
Gemini Links 05/07/2025: Negative Questions and 'Touching Grass' (Going Outside)
Links for the day
Links 05/07/2025: Dalai Lama Succession as 90th Birthday Approaches, 40 deg C in China
Links for the day
Links 05/07/2025: Hungary and US Defecting to Russia, "Google's Hotseat Hypocrisy"
Links for the day
Gemini Links 05/07/2025: 4th of July 2025 and "Zig Roadmap 2026"
Links for the day
How to Combat the Exploitation and Abuse by Microsoft GitHub
Not to mention corruption and crimes against women
Bryan Lunduke is Actually Sending His Audience to Attack People
"[Lunduke] is actually sending his audience to attack people."
Even The Right Wing is Rejecting Bryan Lunduke
no wonder he became so irrelevant and marginal
Microsoft's MSN Helps Microsoft Spread Lies About the Layoffs' Scale (Well Over 25,000 People Laid Off This Year)
There seem to be monopolies on lies and on truth
The Death of X Has Been Greatly Exaggerated (by Compromised Media)
X.Org Server is alive and well
In 2025 Everything is "AI". Remember Blockchains?
Talk about what companies and things (services, products, software) actually do, not the labels they use
Julian Assange Has Been Free for a Year
Julian Assange and I disagreed on some things
Monopolies and Scalping
Monopolies gravitate towards price hikes
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, July 04, 2025
IRC logs for Friday, July 04, 2025
Microsoft's August Layoffs Wave: "August is Confirmed for Additional Performance Based Cuts"
"August is confirmed for additional performance based cuts from the recent connects along with additional organizational cuts."
Links 04/07/2025: Google Replaces the Web With Slop, "AI Might Kill Us All"
Links for the day
Gemini Links 04/07/2025: Mindfulness and F1
Links for the day
Weeks After Microsoft Bankruptcy in Russia the Company Shuts Down in Pakistan, Too
Last month Windows' share in Pakistan fell to an all-time low
Rob Musial's June 2025 Additions of Malware in Proprietary Software
Via the GNU Web site this week
Links 04/07/2025: Microsoft's H-1B Visa Applications Show Another Crisis Unfolding, Many More Deep Cuts and Shutdowns Revealed, Complete Microsoft Exits
Links for the day
Gemini Links 04/07/2025: A Day To Remember and "Stop Killing Games"
Links for the day
Crime and Corruption at Microsoft GitHub Cannot be Covered Up by SLAPPs in Another Continent
We'll write about this for a long time to come
Slop Videos Are Disappointing Garbage, Nothing New, Just Brute Force up on Display or a Pedestal of Slop
Slop videos aren't a new thing
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, July 03, 2025
IRC logs for Thursday, July 03, 2025
The War on Local Storage (People Hosting Their Files Locally and Privately)
There's nothing wrong with controlling one's computing
What Digital Independence Means
Independence in the digital realms means abandoning platforms like GitHub, not just rejecting proprietary software
NVidia is a Bubble
they temporarily see fortunes and wrongly assume perpetuity thereof
Fedora Does Not Care About Diversity and Inclusion, It's About Optics (Corporate Image)
any notion of inclusion is superficial and misleading
Don't Buy the Excuses for Microsoft's Mass Layoffs
Back in the 90s, Microsoft bought a lot of companies to get and stay ahead