3 ms·

I said trusted, not encrypted. I wasn't talking about private keys at all. I think I understand the issues involved. Thanks though.

• dredmorbius 10y ago
  And I still disagree on that point. Maybe I misunderstand (though I also think I understand teh issues involved pretty well), or maybe one or the other or both of us are communicating poorly. How would you distinguish a trusted, encrypted, and untrusted channels, say?
  • btrask 10y ago
    In the context of sharing public keys, I'd say you merely need authentication. Web of Trust being one possible mechanism. This isn't a particularly advanced topic. Relevant to my original post, information about whether the connection should be encrypted also merely needs to be authenticated, not encrypted itself. Of course, the HSTS preloading site uses HTTPS (with encryption) because it's easy and why not.
    • dredmorbius 10y ago
      Thanks. So re keysharing, authentication is a form of secure channel. I'm reading the auth and channel as independent. Auth is something of a metachannel, perhaps.
      • btrask 10y ago
        Fair enough. :)