Re:DKIM: Show Your Privates
by tialaramex on Tuesday November 03, 2020 @02:50AM
(#24977399)
Maybe I didn't do a great job of making my point. You dismiss this as "a hack job piled on top of a hack job" and I gave another example of such a thing (TLS 1.3) which you agree is in fact secure anyway. My point was that this argument is, at best, flimsy.
My point wasn't that magically the existence of TLS 1.3 makes email secure but that TLS 1.3 is "a hack job piled on top of a hack job" too and it's fine.
However, since we're here now: Depending on which browser you use there are two potential answers to your question.
In Firefox the answer is always that Mozilla decided that the CAs which are members of its root trust programme met its requirements. Mozilla's oversight of the Web PKI happens entirely in public. If you have a specific reason to think there's a problem at a CA based in Turkey or Mainland China which is a member of that programme you should raise it.
Otherwise, this decision was made by your OS vendor. If you use a Free Unix then in effect that's still Mozilla since all the popular Free Unix system implicitly or explicitly delegate this to Mozilla, but if it's Google, Apple or Microsoft then that's a matter for them, and they do not have public oversight, good luck with that.
Now, since you mentioned Turkey and Mainland China specifically that would narrow things down a lot (unless you run Windows). Mozilla only trusts Kamu (the Turkish government CA) for Turkish stuff, so, it's unclear what sort of threat you imagine they impose. When I say "Turkish stuff" I mean like the Turkish government's sites, its military, schools that sort of thing, not say a Reddit about Turkey. TURKTRUST which you might have heard of is not trusted at all.
When it comes to the Chinese mainland (as opposed to Hong Kong or Taiwan) there are several more, including GDCA and CFCA but we don't have any particular reason to doubt these authorities behave in accordance with policy. They seem to be exactly what you'd expect, for example CFCA is a financial outfit, and sure enough it issues certificates to various Chinese banks. Would it be a good idea for a foreign critic of China to keep money in those banks? Perhaps not, but that's hardly a problem with the CA.
My point wasn't that magically the existence of TLS 1.3 makes email secure but that TLS 1.3 is "a hack job piled on top of a hack job" too and it's fine.
However, since we're here now: Depending on which browser you use there are two potential answers to your question.
In Firefox the answer is always that Mozilla decided that the CAs which are members of its root trust programme met its requirements. Mozilla's oversight of the Web PKI happens entirely in public. If you have a specific reason to think there's a problem at a CA based in Turkey or Mainland China which is a member of that programme you should raise it.
Otherwise, this decision was made by your OS vendor. If you use a Free Unix then in effect that's still Mozilla since all the popular Free Unix system implicitly or explicitly delegate this to Mozilla, but if it's Google, Apple or Microsoft then that's a matter for them, and they do not have public oversight, good luck with that.
Now, since you mentioned Turkey and Mainland China specifically that would narrow things down a lot (unless you run Windows). Mozilla only trusts Kamu (the Turkish government CA) for Turkish stuff, so, it's unclear what sort of threat you imagine they impose. When I say "Turkish stuff" I mean like the Turkish government's sites, its military, schools that sort of thing, not say a Reddit about Turkey. TURKTRUST which you might have heard of is not trusted at all.
When it comes to the Chinese mainland (as opposed to Hong Kong or Taiwan) there are several more, including GDCA and CFCA but we don't have any particular reason to doubt these authorities behave in accordance with policy. They seem to be exactly what you'd expect, for example CFCA is a financial outfit, and sure enough it issues certificates to various Chinese banks. Would it be a good idea for a foreign critic of China to keep money in those banks? Perhaps not, but that's hardly a problem with the CA.