3 ms·
I found your last paragraph especially well phrased! You're also on point regarding the CAA records. But to me the current system still feels too reactionary.
by 0x0 9y ago
I found your last paragraph especially well phrased!
You're also on point regarding the CAA records. But to me the current system still feels too reactionary. I'd love to see a system where we need to put less trust in all third parties playing by the rules pinkie-promise. Diginotar, StartSSL and Symantec are all examples of CAs gone wild, and I think we've just seen the tip of the iceberg yet.
- zaarn 9y agoAnd all examples of CAs essentially no longer in business (or bought up by DigiCert).
- 0x0 9y agoYes, but after the damage was done and only because the damage happened to be uncovered.
- zaarn 9y agoWell, obviously yes. The CA/B mailing list can't do much about shady behaviour they don't know anything about. I do trust in Mozilla to ensure that the game rules for CAs are strict enough that my trust in the green lock isn't 0. It's not 100% either but it's above 50%. When I connect to a website and it has SSL, I'm fairly certain it's the right place. Most likely there will never be a replacement for it, any PKI requires some third party to vouch for an endpoint otherwise you get easy MitM (I believe there is a proof floating around somewhere from the area of Signal Theory).