[Discuss] root CA bloat

[Tom Metro]

Edward Ned Harvey (blu) wrote:
> There are class 1 and class 2 certs, and higher, but of course
> there's no differentiation client-side.  It's simply "Ok" or "Not
> Ok."  So the question of "how much I trust" some particular cert is
> an interesting question - extending not just to which CA issued the
> cert, but other factors as well, including the class of the cert, the
> cipherspec, key strength, etc.

True, it is a spectrum...so how abut this:

The extension provides a dialog where you configure which factors to
consider and how to weigh them, with reasonable defaults to get you started.

It takes into account the cert class and whether it is an EV cert.

It could use the SSL encryption options as additional factors. Using an
old encryption algorithm? Down-ranked. Not using perfect forward
secrecy? Down-ranked. (See https://www.ssllabs.com/ssltest/)

It provides CAs grouped into collections, and lets you assign trust
levels to those groups. So if you want to trust the CAs in your home
country more than foreign countries, you can do that. If you want to
assign a high trust the CAs used by sites ranked in the Alexia top 1000,
you can do that. (The groups get recomputed and downloaded periodically.)

It provides a way to apply exceptions to the list of CAs that are in a
group. So if you want to moderately trust Asian CAs in general, but not
the Hong Kong Post Office, you can kick it out of the group.

It provides a crowd-sourced rating mechanism, so end-users can report CA
incidents against a CA and down-rank it.

(If you make use of downloaded groups and crowd sourced rankings, you've
shifted some of your trust to a 3rd party, so now you have to decide how
much you trust the extension that the people managing it.)

Then in the browser UI, instead of displaying a single color, you get a
bargraph that shows the aggregate value of all the trust metrics with
shades from red (untrusted) to green (fully trusted), or the whole thing
grayed out for no cert.

 -Tom

-- 
Tom Metro
The Perl Shop, Newton, MA, USA
"Predictable On-demand Perl Consulting."
http://www.theperlshop.com/