Comment by jesuswasjew
20 hours ago
CA Forum, Apple, Google and Mozilla are to be blamed for just giving license to random no security background far away company.
20 hours ago
CA Forum, Apple, Google and Mozilla are to be blamed for just giving license to random no security background far away company.
Yes, its all very well someone here shouting about "the absolutely brutal question battery the Chrome team publicly submitted to eMudhra".
But in all honesty there are serious questions to be asked about:
a) The initial approval process for ANY CA
b) The ongoing monitoring process for ANY CA
The fact this CA was based in India ultimately has nothing to do with it if we are being completely honest here.
Clearly there is a fundamental problem with the overarching approval and monitoring process which means it could have happened anywhere. This time it just happened to be India.
Secondly, in direct reference to the "far away company" comment India does have quite strict controls on both certain technical things (speaking generally here, not specifically in relation to certs ... e.g. use of sat phones). And in general it is quite difficult (read: almost impossible) to turn up in India and do business as an external company. So there is probably a genuine need for an Indian company CA since not every body can/wants to use Let's Encrypt or whatever.
> The fact this CA was based in India ultimately has nothing to do with it
Oh, then you will be missing more than half the fun of this thread. The sleeper agent racist in good people of the good part of the globe come knocking whenever a third world country (with a somewhat decent economy) comes in the news for bad reasons. You have also seemingly missed the threads about space related failures and accidents related to this country here. Those will be interesting to read. There are very subtle terms being used in some comments like "their worldview" et cetera.
> genuine need for an Indian company CA
Should be for pretty much any country and those certs should be trusted like other certs are trusted!!! Otherwise change the way these chains/trusts work.
> since not every body can/wants to use Let's Encrypt or whatever.
No they don't. It's an American company. (Let's not begin about "non-profit" part of it).
CA approvals are bad. From 2000 to 2015, I ran an org where we allow-listed a modest subset of the the CAs that were approved by Google, Microsoft, and Mozilla. There were too many incidents and bad actors.
Microsoft, in particular, had strong transparency around CA approval processes that were reasonable. It was weird.
> Far away company
Far away from the default country?
The charitable interpretation is a company whose operations they have no idea about due to distance.
The only true country. Land of the free. Gaad's country. (Mallu mates, it's different from God's country, fret not).
Far away from the nearest technologically competent country where this would not happen
That country you describe doesn't exist.
4 replies →
like most governance body, they check independent audit reports, not the actual operation.
This is a sample on what it looks like during covid lockdown : https://bugzilla.mozilla.org/show_bug.cgi?id=1728790
Not to give into conspiracy theories but this company might be ideologically even if not materially aligned to current regime in India. With right kind of nudge any kind business contract is possible without any competency.
You seem to have an axe against current Indian regime which is not even outside the overton window. I suggest to not get your information from liberal-arts educated islamophile journalists who are struggling to pay off their loans.
As a reminder Mozilla was warned not to add the Chinese government as a ca they pushed back claiming lack of evidence and only removed them as a ca once cnnic got caught issuing certs for google domains (by accident )
Yes, not sure what the timeline was where trust was given to this company. Just horrible for the entire secure Internet. They've yet to answer many of the basic questions raised throughout this process too.