3 ms·
The entire CA model is fundamentally broken: I rely on an entity I have no relationship to vouch for entities it has a relationship with. That makes no sense.
by zeveb 10y ago
The entire CA model is fundamentally broken: I rely on an entity I have no relationship to vouch for entities it has a relationship with. That makes no sense. The way it should work is that I rely on an entity I do have a relationship with to vouch for entities.
Could be public, could be private (I'd prefer private, since that would make resiliency, competition & experimentation more likely).
- icebraining 10y agoTechnically, you have a relationship: you have their certificate in your computer for your browser to validate against. You can remove it and/or add others. The problem is that a single entity can vouch for each site, so if you don't want to trust it, you can't validate the site at all. Moxie's Convergence[¹] proposal - like Carnegie Mellon's Perspectives Project before - avoids this problem by allowing many entities to vouch for the same site. [1] https://en.wikipedia.org/wiki/Convergence_%28SSL%29 https://en.wikipedia.org/wiki/Convergence_%28SSL%29