Re: [Trans] Another Question about the PRIVATE option (Ticket #1)

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Mar 18, 2014 at 7:26 AM, Ben Laurie <[e-mail]> wrote:

> On 17 March 2014 23:40, Rick Andrews <[e-mail]> wrote:
> > I have another question about the PRIVATE option. While planning the
> implementation of CT with our teams, we first thought that we would use the
> precertificate option as the default for all customers. Our hope was that
> most customers wouldn't even need to be aware of CT; they would get some
> extra data in their cert and there would be no change to deployment (I
> believe that was the hope of the CT designers too).
> >
> > However, the PRIVATE subdomain masking option made us rethink that. If a
> customer wants to keep their fqdn private, they need to make that choice up
> front, before we've issued the cert to them. If they don't choose PRIVATE
> up front, their cert will get logged, and switching to PRIVATE after that
> would be pointless because their fqdn would be public. But that means
> forcing the customer to stop in the middle of the enrollment process, read
> up on CT, and make an informed decision. We're finding it's difficult to
> get most people to understand why they would choose SHA-2 instead of SHA-1,
> and educating them on CT and its options is expected to be far more
> difficult.
> >
> > So we're considering making PRIVATE the default option, or perhaps the
> only option. It's arguably better for customers because it preserves a
> measure of privacy and postpones the time when they have to understand all
> the details of CT. It may be a little more challenging for a domain owner
> monitoring the logs, because they'll only see the precerts with serial
> numbers and no fqdns, but that's not much of a challenge. It makes our
> implementation simpler and therefore easier to test and deploy.
> >
> > Any feedback on this idea?
>
> Interesting. I guess the difficulty would be in deciding how many
> names to elide. For example, consider the uk.com domain vs.
> example.com.
>
> secret.example.uk.com should be registered as <PRIVATE>.example.uk.com
> (since uk.com is effectively a TLD). However,
> secret.verysecret.example.com should be <PRIVATE>.example.com.
>

This came up in the DNSOPs meeting. There is a lot of discussion about how
to represent changes of administrative authority in the DNS.

Unfortunately it is focused mostly on fixing cookies which is trying to fix
stupid which is never going to produce a sensible result. But there is
already a zone prefix list used for issue of wildcard certs.

The problem of <private>.<domain>.foo.com looks to me to be the same as the
problem of *.<domain>.foo.com.

*.uk would be a bad thing...

-- 
Website: http://hallambaker.com/