An Interactive Graph of the Certificate Authority Ecosystem 39
An anonymous reader writes "Researchers of the International Computer Science Institute in Berkeley have created an interactive diagram that shows root-CAs, their intermediates, the relationships between them and how many certificates have been signed by them. The graph was generated by passively monitoring the Internet uplinks of a number of (mostly) edu sites for SSL connections and their certificate Information. Among other things the graph shows that one GoDaddy intermediate signed more than 74,000 certificates and that a German CA uses more than 200 sub-CAs for administrative reasons."
Re: (Score:2)
Re: (Score:3)
Not bad, but... (Score:5, Funny)
Re: (Score:3)
How is that useful? (Score:2)
The graphic is a lie (Score:5, Insightful)
The graph, while cool, sucks!
It implies a root signer, which isn't really there. By clumping all the various networks identified within a circle, they make it look like there are connections between the networks that don't really exist.
Look carefully around the edge between the inner and outer circles, there's nothing that bridges them.
Now look carefully around the outer circle, you'll see it isn't one continuous network, it's a bunch of small networks just sitting next to each other.
The whole reason for putting data in a graphic is so that you can draw new meaning from visual clues because the human brain is so good at interpreting visual information. However, if you force stuff into shapes like this, you imply meaning that isn't really there.
Re: (Score:2)
Re: (Score:1)
You misinterpreted the "The graphic is a lie" in parent.
Reason it is a lie is cause it gives an impression they are all connected, whereas they are not. It should have been grouped in several circles.
Re: (Score:2)
That, and it makes me think there's probably a hidden '23' in the plot that I can't see because of the colors they chose.
Re: (Score:2)
...they make it look like there are connections between the networks that don't really exist.
Hey, I'll be the first to say I probably don't understand this as well as I should, but isn't this a map of CA relationsips, and not "network connections"? Or by "network" do you mean the network of CA authorities?
Re: (Score:3)
Truth: Most of the CAs are in tiny closed relationships and have no connection to others.
Graph: Huge lump of CAs, making it look like they are all interconnected.
Re:The graphic is a lie (Score:5, Interesting)
Actual truth: Most of the CAs are Symantec, using multiple names to make it appear there is actually competition.
Graph: Huge lump of CAs making it look like they aren't all Symantec.
Re: (Score:2)
I meant the network of CA authorities.
If this graph was accurate, it would look like a bunch of individual unconnected clusters, with one particularly large cluster. But clearly the creator was too interested in forcing it to look like on of those color-blindness tests.
This is a godsend (Score:2)
Such a great tool. Thank you Berkeley.
CAs are an extortion racket. (Score:2)
Set up a few servers and mint cash.
Best idea I ever heard was that the US Post Office should become a CA, I'd use them instead of the current bunch of swindlers who do the minimum acceptable job at the highest acceptable price.
Re: (Score:2)
Zoom! (Score:2)
sub-CA hell (Score:2)
DFN-Verein "creates a unique sub-CA for each institution for which it issues certificates"
I feel sorry for the technical folks who have to implement and maintain such a fucked up idea as per-institutional sub-CAs.
Re:sub-CA hell (Score:4, Insightful)
And why is that? This is actually exactly how the CA structure was designed to work, not that commercial "we'll protect you from anyone we don't take money from"-crap, involving RAs and other unchecked entities that can use a CA to vouch for something that they haven't even checked themselves, a practice that somehow made it into the gold standard.
The DFN is the german academic research network, and so the guys running that network can vouch for every organisation connected to it. Each organisation is supposed to be able to vouch for the certificates they issue. What's your problem with that?
Personally, I think the whole PKI thing is FUBAR, since only one super is allowed to vouch for a sub and you're effectively forced to trust someone else's CA collection (down to a certain vendor silently undoing your changes to the store on your operating system come every update check). To make digital trust workable I, end user, have to be able to choose whom to trust, a choice I currently do not have, in fact cannot have lest my intarwebz stop functioning!
But in the case of the DFN, the hierarchy is exceptionally clear and one of the few places where it actually makes sense. And maintaining 200 sub-certificates is a lot less work than maintaining millions upon millions of certificates issued on a couple bucks and a grainy copy of your passport. What does that prove anyway?
Re: (Score:2)
OH I definitely agree that the system is broken. Just looking at the site should make anyone on the internet ask themselves, "who the hell all these CAs are and do we really trust them with our most personal data"?
Yes, I think that encrypting your traffic securely is the right thing to do, and using public-private key pairs with cryptographically strong algorithms is the right way to do it, the trust model was broken the first day that money started to change hands as a surrogate for "trust"
Re: (Score:2)
Just looking at the site should make anyone on the internet ask themselves, "who the hell all these CAs are and do we really trust them with our most personal data"?
You are very confused. Alas, you are spreading your confusion around.
The whole design of SSL and public key infrastructures means that you don't trust the CAs with your personal data. Indeed, you hardly ever need to communicate with the CA directly at all. You just trust them to make accurate statements about hosts of websites. You then have to decide whether to trust that site with your personal data. Thus, no matter who signs the SSL certificate for Facebook, I'm not trusting them with my personal data...
Re: (Score:2)
No, I'm fully aware we don't trust the CAs with our personal data. We're trusting the CAs to vouch for the organizations to whom they issue certificates. But now there are hordes of CAs, some of whom may not be particularly trustworthy, but the browser makers don't descriminate (much).
As a result, we have CAs that we're supposed to trust because our browsers accept them, but those CAs are passing out SSL certs like candy to anyone with a few bucks.
While we're not directly giving our personal data to the CA
Re: (Score:2)
Personally, I think the whole PKI thing is FUBAR, since only one super is allowed to vouch for a sub and you're effectively forced to trust someone else's CA collection (down to a certain vendor silently undoing your changes to the store on your operating system come every update check).
If you're referring to the Windows utility to update root certificates, that can be easily disabled.
To make digital trust workable I, end user, have to be able to choose whom to trust, a choice I currently do not have, in fact cannot have lest my intarwebz stop functioning!
Why not? It's quite possible to remove all root certificates from your system and only install those that you trust. If you're concerned about the trustworthiness of a root, you can install a certain server cert (though you may lose such benefits like OCSP or CRL checking, as those are signed by the roots).
The ICSI Certificate Notary (Score:2)
So this graph is publish by the ICSI. They're getting into the "notary" game: http://notary.icsi.berkeley.edu/ [berkeley.edu]
They reference Perspectives [perspectives-project.org] as the pioneer of this scheme and also mention Convergence [convergence.io].
ICSI's Certificate Notary offers itself as different: "our notary collects certificates passively from live upstream traffic at multiple independent Internet sites, aggregating them into a central database in near-realtime." I'm not sure this is an improvement.
Octave (Score:3)
Redundancy, Robustness and Hubs (Score:1)