Re:Stop the proposal on mass surveillance of the EU
by yencabulator on Friday February 03, 2023 @06:36PM
(#34649416)
That's all available from Certificate Transparency. Chrome refuses certificates that haven't been submitted to CT.
AC Camerfirma seems to operate multiple CA certificates (e.g. some labeled by year). Here's a search that finds certificates issued by one of them: https://crt.sh/?Identity=%25&iCAID=51020
Taking the first one: AC Camerfirma S. A.
I suspect I've never authenticated anything against that CA. I'd love to know what sites it has authenticated, and maybe I'd be happy with a lot of .es sites
Wouldn't surprise me if I rarely if ever encounter 80% of the CAs that I trust. Looking through I'd be happy if some of the signed .ae, or .cn, but not .de.
If I did visit an unusual CA, I'd like to make a judgement call on that access. Sure, the big ones (letsencrypt, globalsign, etc) woul dneed to just trust completely, but having a "you are visiting youremail.com, last time you visited this was signed by Globalsign with a certificate expiry of 5 months time, today it's signed by Odd Looking CA, continue?
Sure for 90% of users would click though, and it shouldn't be an option for 90% of users, but I'm not 90% of users.
Same with importing. If I make my own certificates for my own stuff, I want to import my CA and trust if for .mydevdomain.com, but not for mybank.com, because I don't trust my own security enough to have anyone, including me, have a skeleton key to my entire communication chain for key sites.