2 ms·
If only intentions made the world go round. But how we use things, and build upon them, is often rather more interesting than what someone intended. The comme
by inopinatus 11y ago
If only intentions made the world go round. But how we use things, and build upon them, is often rather more interesting than what someone intended.
The commercial CAs will be a relic. It's only a matter of time before the whole house of cards collapses. The price pressure has been downwards for years. EV is not meaningful to most end-users, remaining a money-printing scam that provides little assurance of safety (if Enron, or Ashley Madison could get one, what's it worth?), and is vulnerable to MITM and rebinding attacks[1].
I anticipate that Amazon's CA[2] could undermine the profitability - and via desperation, the integrity - of the whole sector even further.
[1] http://www.blackhat.com/presentations/bh-usa-09/ZUSMAN/BHUSA09-Zusman-AttackExtSSL-SLIDES.pdf http://www.blackhat.com/presentations/bh-usa-09/ZUSMAN/BHUSA...
[2] http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-certificate-provider-applies-to-be-a-root-certifcate-authority/ http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-cer...
- realityking 11y agoHow is it relevant that Enron or Ashley Madison could get EV certificates? They are intended to proof that you're communicating with whom you intended to communicate. They make no claim about the trustworthiness of the company itself (and how would you even test that?)