3 ms·
No matter what, you have to trust someone, and any method that requires first-time click through every time on every new website is bound to exhaust users, resu
by lend000 10y ago
No matter what, you have to trust someone, and any method that requires first-time click through every time on every new website is bound to exhaust users, resulting in them clicking through blindly. At least a certificate violation is a rare enough event, although as mentioned, it can potentially be corrupted by the CA. Regardless, you trust the browser implementation.
A better solution might have browsers try to intelligently identify suspicious looking URL's (including URL's that start with a popular, external URL, like paypal.com.notpaypal.cc). As for the actual certificates themselves, perhaps this is a good application for a Blockchain technology, with certs being created by website owners and submitted to a Blockchain by a machine assigned to the DNS name that wants to create its cert. But in this case, we still require DNS which is built on trust... so perhaps DNS could also be put on a blockchain. How? I don't know. But until we figure that out, we have to rely on various organizations to provide trust.
- dchest 10y agoresulting in them clicking through blindly In the proposed scheme, they are ALWAYS clicking though blindly. There's no way for a user to know when he gets the original public key or someone else's. How is a user supposed to verify it, call the owners of the website and ask them to dictate their public key? This warning screen is thus just a security theater. The whole proposed "solution" is not a solution at all and doesn't work — the author could have saved a lot of time typing this blog post if they just listed threats that certificates are trying to solve on a piece of paper and put a check mark next to each if their proposed "solution" solves it.