4 ms·

It's a tradeoff I guess, at the low end people don't want to provide documents, wait and pay a decent amount to get their identity verified. Maybe it would be

by robryan 16y ago

It's a tradeoff I guess, at the low end people don't want to provide documents, wait and pay a decent amount to get their identity verified. Maybe it would be best to separate them, you can self sign or equivalent for encryption and the identity system can be separate.

Retric 16y ago
There is little point in encrypting traffic if you can't differentiate between a man in the middle and your desired endpoint. EX: Conceder I open encrypted connection to amazone.com which pretends to be amazon.com they open an encrypted connection to amazon.com. Amazone can now pretend to be Amazon and read all my encrypted traffic.
- Dylan16807 16y ago
  Consider someone sniffing wifi. I'm worried about eavesdropping much more often than man in the middle, and nontrusted SSL could provide that if browsers would stop freaking out and just go without a padlock.
- klync 16y ago
  Users can differentiate between "amazon.com" and "amazone.com" via the browser's location bar. There's nothing stopping the owner of "amazone.com" from getting an SSL cert signed by a "trusted authority", so SSL does not help in this respect. My opinion is that conflating identity with encryption is a fundamental problem.
  - Retric 16y ago
    Some users can differentiate... assuming they notice. The issue is in the real world building a system to handle both typos and hostel networks requires some form of authentication.
tbrownaw 16y ago
You need some amount of identity checking, to tell you that the https://uncesnsored.citadel.org/ https://uncesnsored.citadel.org/ you're talking to today is the same one you were talking to yesterday and last week. SSH handles this by remembering the key used on the first connection; Perspectives goes one better and checks from multiple parts of the network. Tying these online identities to physical-world identities is what can be separate.

by robryan 16y ago

Retric 16y ago

There is little point in encrypting traffic if you can't differentiate between a man in the middle and your desired endpoint. EX: Conceder I open encrypted connection to amazone.com which pretends to be amazon.com they open an encrypted connection to amazon.com. Amazone can now pretend to be Amazon and read all my encrypted traffic.

Dylan16807 16y ago
Consider someone sniffing wifi. I'm worried about eavesdropping much more often than man in the middle, and nontrusted SSL could provide that if browsers would stop freaking out and just go without a padlock.
klync 16y ago
Users can differentiate between "amazon.com" and "amazone.com" via the browser's location bar. There's nothing stopping the owner of "amazone.com" from getting an SSL cert signed by a "trusted authority", so SSL does not help in this respect. My opinion is that conflating identity with encryption is a fundamental problem.
- Retric 16y ago
  Some users can differentiate... assuming they notice. The issue is in the real world building a system to handle both typos and hostel networks requires some form of authentication.

tbrownaw 16y ago

You need some amount of identity checking, to tell you that the https://uncesnsored.citadel.org/ https://uncesnsored.citadel.org/ you're talking to today is the same one you were talking to yesterday and last week. SSH handles this by remembering the key used on the first connection; Perspectives goes one better and checks from multiple parts of the network. Tying these online identities to physical-world identities is what can be separate.