3 ms·
Nobody has come up with a user-comprehensible abstraction to represent the machinery needed to represent the chain of actors needed to assert that "this is real
by statictype 16y ago
Nobody has come up with a user-comprehensible abstraction to represent the machinery needed to represent the chain of actors needed to assert that "this is really Bank of America". Instead, we wound up with a buried configuration box that says "Verisign is God.
Isn't this a good thing?
I'm not sure its possible to represent the mechanism in any other way that doesn't involve actually having to teach users about how SSL works.
- tptacek 16y agoThere must exist something in between sharing nothing with end-users (the situation we have now, where sites are literally either "secure" or "not" --- and, incidentally, a situation that DNSSEC actually makes worse) and sharing ServerKeyExchange and CertificateRequest messages. My guess is that the answer will involve having something more meaningful than the name "Verisign" at the root of the certificate change. "Secure Banking Sites", which ideally would be managed by (wait for it) secure banking sites, sounds better. We can get to that world without forklifting out OpenSSL.