The CA's Role in Fighting Phishing and Malware

I'm not sure that Let's Encrypt necessarily intends to offer users any warranty that the sites that receive certs are trustworthy or not malicious. Part of the idea that I took from Josh's post, and from other related discussions that I've been in, is that the idea that a CA is "vouching for" a site or saying that the site is "trustworthy" is a layering confusion, and one that, if it persists, could permanently prevent us from having a 100% encrypted Internet.

That doesn't mean that there's no such role to be performed as telling people about whether sites are trustworthy and whether sites are likely to harm them, but if people expect that function to be in the same service as TLS name/key bindings, we may not get that much ubiquity and automation for the name/key binding because human beings are getting put back in the loop.

This might be a reason that Let's Encrypt may not want to have a brand in the same way that some other CAs have.

4 Likes