5 ms·

Doesn't moving everything to https make the Web even more centralized? In order to use it looks like site's have to submit to a certificate authority now.

ajross 10y ago
For some definition of "submit", I guess. Non-EV certificates are based on domain ownership. If you can prove you own the domain (e.g. Let's Encrypt just checks that you can host a static file on a HTTP page on the certified hostname) then you can get a cert for it. Obviously you still have to "submit" to the domain registrars also...
- paulddraper 10y ago
  It was always centralized (though "federated" would be more accurate), with allocated IP blocks and domain registrars.
zer0gravity 10y ago
It is. There will also be a high incentive for hackers to attack at take control of some certificate autorities. And it will be worse than accepting self signed certificates as trusted solutions...
- nathanaldensr 10y ago
  Wouldn't hackers already have that incentive? It seems like virtually all sites worth targeting would already be secured by TLS certificates, so the remaining sites wouldn't provide much value to hackers.
  - zer0gravity 10y ago
    They would. And apparently they're doing it with some success, judging by all the passwords leaked lately. We can assume there were other "successes" that were not made public yet.. So yeah.. enforcing https may be the same as trying to patch a hole when the bag is wide open.. It will simply become even less feasible for sombody to host a site without the blessing of the big cert guys... Federalization of the internet is where we are going, but I susppose that's just the faith of all media channels..
    - dylanfw 10y ago
      In what way are you connecting recent password dumps to hackers attacking Certificate Authorities? If someone controlled the CA, they would also need to control the target website and/or the victim's home network in order to MITM the connection and snag the credentials. Also, this would allow them to capture plaintext passwords and as far as I know all of the major password dumps recently have been hashed passwords indicating that the database was breached, not that a CA was compromised and thousands of users were MITMed.
tomjen3 10y ago
Yes. Someday that is going to bite us in the ads, but hey we get the appearance of security (in reality your page is probably served by cloud fare who mitm their customers as part of their business) and we have to trust a bunch of roots that have shown historically to be less trustworthy than a congressman

ajross 10y ago

For some definition of "submit", I guess. Non-EV certificates are based on domain ownership. If you can prove you own the domain (e.g. Let's Encrypt just checks that you can host a static file on a HTTP page on the certified hostname) then you can get a cert for it. Obviously you still have to "submit" to the domain registrars also...

paulddraper 10y ago
It was always centralized (though "federated" would be more accurate), with allocated IP blocks and domain registrars.

zer0gravity 10y ago

It is. There will also be a high incentive for hackers to attack at take control of some certificate autorities. And it will be worse than accepting self signed certificates as trusted solutions...

nathanaldensr 10y ago
Wouldn't hackers already have that incentive? It seems like virtually all sites worth targeting would already be secured by TLS certificates, so the remaining sites wouldn't provide much value to hackers.
- zer0gravity 10y ago
  They would. And apparently they're doing it with some success, judging by all the passwords leaked lately. We can assume there were other "successes" that were not made public yet.. So yeah.. enforcing https may be the same as trying to patch a hole when the bag is wide open.. It will simply become even less feasible for sombody to host a site without the blessing of the big cert guys... Federalization of the internet is where we are going, but I susppose that's just the faith of all media channels..
  - dylanfw 10y ago
    In what way are you connecting recent password dumps to hackers attacking Certificate Authorities? If someone controlled the CA, they would also need to control the target website and/or the victim's home network in order to MITM the connection and snag the credentials. Also, this would allow them to capture plaintext passwords and as far as I know all of the major password dumps recently have been hashed passwords indicating that the database was breached, not that a CA was compromised and thousands of users were MITMed.

tomjen3 10y ago

Yes. Someday that is going to bite us in the ads, but hey we get the appearance of security (in reality your page is probably served by cloud fare who mitm their customers as part of their business) and we have to trust a bunch of roots that have shown historically to be less trustworthy than a congressman