2 ms·

Mostly #5, with some of #4. We have known bad certs in the wild (including for Google) so the "security" PKI offers us is just theater. I think the theater shou

Mostly #5, with some of #4. We have known bad certs in the wild (including for Google) so the "security" PKI offers us is just theater. I think the theater should end, which might actually get people off their asses to fix the real problem and stop outsourcing it to shady rent-seeking companies.

tptacek 10y ago
If the security the CAs offer is "just theater", go spoof DNS and phish Bank of America logins; you should be able to trick users just by rolling self-signed certificates.
- bandrami 10y ago
  You do know that BofA is one of the organizations with verified bad certificates in the wild, right? This isn't just a theoretical worry. That's why it's "theater": we know that right now there are valid but bad certificates for a depressing number of entities.
  - tptacek 10y ago
    Feel free to win the argument by presenting me with a Bank of America certificate that my browser will validate, which wasn't generated by Bank of America.
  - geofft 10y ago
    Cool, how do I get one of those? In scenario 5 or 4, it is easy for me (not "someone", me) to get one of those.