4 ms·
SSL is not fundamentally broken. The server authentication process is. Besides what does web-of-trust add? The client usually does not authenticate himself to t
by cntlzw 9y ago
SSL is not fundamentally broken. The server authentication process is. Besides what does web-of-trust add? The client usually does not authenticate himself to the server. How should a client share "hey, I trust this server" with others?
- _jal 9y agoReal-world SSL is broken above a risk threshold. There are far too many trusted CAs that have repeatedly demonstrated incompetence and all of them are beholden to governments. (There are far too many, period, or in the alternative far too few.) If you have high assurance requirements, SSL with commercial CAs can't be trusted. We have natural experiments showing that WoT, at least as implemented, doesn't scale. I hate that humans don't seem to be able to make it work, but that's reality for you. Yes, I am a security pessimist.