The whole idea that famous Let’s encrypt is some risk just because some voters were concerned so much about gas and groceries prices so much they elected a fascist bastard, is so…. “who could expect this 10-20 years ago?” thing.
I bet Mozilla and Google would lobby the @EU_Commission against this important aspect of EU digital sovereignity.
Yes, EU would need own certificates authority. But not because it is better than other centralized certificates authority. But because it would be easier and faster to do compared to transition to some decentralized alternative of internet where people exchange contacts like cards with addresses and phones in the past, and sites admins and authors add themselves in some well-respected human-reviewed catalogs of contact cards like “Yellow Pages”, as replacement for current pyramidal DNS & SSL certificates of today.
I am not sure how is the best way to deal with all that, but it seems it would end need with some kind of that address/phone book for websites described in the Web Numbers article… But even without the central authorities of SSL.
May be it would be something like that: If you are about to navigate into website, it depends on how it navigated:
- from contact address book? Trust if same certificate as before.
- from typing address in address bar or new certificate? Broadcast question for trust across peer to peer networks, something like “who trusts 1234:44444 declaring to be tasty.blog and certificate signature 12AB45DE3WXZ”?
- Navigating to new website missing in known sites/contacts library from a known site? Ask known site for trust about site you navigate into the first time, or broadcast trust query, or both.
If site or certificate is new, then it would be an UX quest to solve, to represent results of trust query to a non-techy person.. Of course if there are contacts that are trusting that hypothetical tasty.blog website, they can be shown in the related popup? But would it be some violation of their privacy to show that person, let it be Malory, the fact that Jane and Alex trust this website identity? Even if at UX level, “3 your contacts can confirm identity of this website”?
Making all websites a sort of invite only, like “Mary gave you link to this tasty.blog website. Add it to your address book?”… Will it ever work?
I know this would be completely new internet that is basically semi-compatible with standard one, and for today browser it would be similar to visiting first time a site with self-signed (or semi-self-signed with not-trusted root) certificate. Unless some extension would be created that would allow such kind of address-book kind of DNS & SSL functionality. But such extension of course would be incompatible even with old extensions APIs, and with newer more restricted too… And having some local proxy would end up with auto-transform of all links into
//For site from your local address book
https://127.0.19.45/from_book/site_name/page_path?a=1
//for new site that is not in a book - ip address, port, and certificate hash
https://127.0.19.45/new/1.99.11.15/443/AB444ZYC...3425/page_path?a=1
I just tried to imagine how it (internet without centralized SSL and DNS but with these address books or Web Numbers) would look like without creating brand new browser, even with Servo rendering engine, using the browsers we already have.
To some extent it resembles how the GNS (GNU Net domain name system) works?
