4 ms·
Arguably, the right way of doing it is to use both. PKI to auth first connect, remember the chain to prevent bad CAs from giving certs people pretending to be
by djcapelis 16y ago
Arguably, the right way of doing it is to use both. PKI to auth first connect, remember the chain to prevent bad CAs from giving certs people pretending to be BoA.
- pyre 16y agoWhy not abandon central key authorities and go distributed? Bring social networks and the web-of-trust together. "3 of your friends have said that they trust this certificate from Amazon.com. Do you want to accept it?"
- daeken 16y agoIf I had a dollar for every time a friend clicked a .exe email attachment, I'd be a very wealthy man. I damn sure don't trust my friends to verify the security of a cert.
- drdaeman 16y agoI have some security-savvy friends (who I'd trust) and some not so smart friends (who I don't trust on this subject). So, the obvious idea is to put weight coefficients on WoT digraph edges. But I have a feeling that this would be too complicated to manage.
- konad 16y agoYour mom would trust you and then her friends would trust her, then they'd all get burned because she meant to click No one time and it would all be your fault.
- djcapelis 16y agoI don't care how you set up the PKI. You can use a carrier pigeon trust network if you want. If you can beat SSL's PKI then brilliant. The important part is to use PKI to auth first contact and verify no unseemly changes happen during subsequent contacts by bothering to remember the previous cert chains.