7 ms·
> Those should be distributed by the service providers, who are the actual trustworthy entities in the user's minds. That's what HPKP does, basically, unless I
by pfg 10y ago
> Those should be distributed by the service providers, who are the actual trustworthy entities in the user's minds.
That's what HPKP does, basically, unless I'm misinterpreting what you mean with service providers.
HPKP is Trust on First Use, so it's not perfect, but the alternative - some kind of Web of Trust - is not really practical for non-technical, not-security-conscious users, IMO.
- 5ilv3r 10y agoThis looks like it still uses https. Currently I am giving openkeychain on android a try. It's trust establishment process is very interesting. Sadly I understand https much better than alternatives, due to web hosting experience. I am trying to catch up.