5 ms·
No the problem is that we centralized trust instead of designing a distributed trust model. I suspect we centralized trust at the encouragement of folks like th
by josho 10y ago
No the problem is that we centralized trust instead of designing a distributed trust model. I suspect we centralized trust at the encouragement of folks like the NSA and similar ilk.
Regardless, look at the vast majority of technical users relying on SSH without using a CA for secure communications, had browsers done a better job at self-signed certs we could be doing the same on the web.
- gsnedders 10y ago> Regardless, look at the vast majority of technical users relying on SSH without using a CA for secure communications, had browsers done a better job at self-signed certs we could be doing the same on the web. How many technical users actually check the fingerprint matches the expected one of the server, out-of-band? Almost everyone I know just accepts the unknown fingerprint, so almost nobody knows who the endpoint they're actually connected to is.
- emodendroket 10y agoIt works OK as long as you're connecting to the correct one the first time, I suppose. But yeah, I agree.
- deleted 10y ago[deleted]
- jb613 10y ago> I suspect we centralized trust at the encouragement of folks like the NSA and similar ilk. In the mid-90's, CA certs were put into Netscape Navigator (IE joined later) in order to facilitate the new wild wacky concept that someone might buy something online. They called it "e-commerce". Trust was centralized because it was far easier to add the then ~half-dozen CA's rather then somehow vetting every joe that wanted to self-sign their certs. PGP's web-of-trust existed but it was deemed less viable. Besides, the whole SSL certs thing was a major business premise behind creating Netscape - profits. Without that there might not have been a dot-com and the huge amount of money that followed since then.