3 ms·
This is all good and well, but if we take a step back it pretty much means that anybody can get a DV certificate without any verification, which means CAs are u
by rakoo 11y ago
This is all good and well, but if we take a step back it pretty much means that anybody can get a DV certificate without any verification, which means CAs are useless, which means that DV certificate offer no more guarantees about anything than self-signed certificates.
Which is an excellent thing: maybe we'll finally be able to just use self-signed certificates ? And ask CAs for something where they actually can provide value, ie EV certificates, for as long as we're okay to stay with this model ?
This should be a call to browser vendors: when this is more widespread, accept self-signed certificates as if they were DV certificates !
- Nullabillity 11y agoDV certificates does provide a service that self-signed certificates don't, though: they verify that the server controls x.com according to the public DNS system, not just according to the user's ISP/DNS server.
- avian 11y agoStrictly speaking, they verify that server controls x.com according to the CA's ISP/DNS server/any other parties in the middle instead of the user's ISP/DNS server/any other parties in the middle.
- austerity 11y agoThat's just not true. It changes exactly nothing in the amount of guarantees provided by a DV cert. They guarantee that you are communicating with the domain you think you are communicating with and that there is no man in the middle. Self-signed certs can't provide that guarantee. Of course there's still the question of how trustworthy are the CAs. But I don't believe them charging money for DV certs has any impact on that either.
- deleted 11y ago[deleted]