3 ms·

> I guarantee you a month later Google and Apple and Microsoft will become the de facto CAs Except that none of those companies bother verifying one's identity

by u801e 9y ago

> I guarantee you a month later Google and Apple and Microsoft will become the de facto CAs Except that none of those companies bother verifying one's identity if you're not actually paying for their services. > and see if one of them vouches for their banking website. In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with.

dpark 9y ago
> Except that none of those companies bother verifying one's identity if you're not actually paying for their services. I'm sure in this scenario, those companies will be delighted to step fully into the role of CA including accepting money for identity vouching. > In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with. No. The same couldn't apply to any company. My primary bank is online only. And how many times have you actually walked into an Amazon office? Or Paypal? Are people in Ohio supposed to fly to San Jose to get Paypal's public key when they create an account? Or are we going to wait for the post office to deliver a physical copy of Paypal's public key (and we'll just trust that whole transaction couldn't be compromised). Physical key exchange is simply not practical in most cases.
- u801e 9y ago
  It probably could apply to some that I locally deal with. But you're correct in saying that it's not practical for companies that don't have local branches.
greenhouse_gas 9y ago
>In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with. You could? Would your grandmother? Would you fly to Mountain View to get Google's? And then turn around and fly to Washington DC to get the IRS's? And then turn around and fly to who knows where to get HN's? And then tell them to keep customer staff ready to assist you to install their public keys? And what about personal blogs that don't want to be MITM?

by u801e 9y ago

dpark 9y ago

> Except that none of those companies bother verifying one's identity if you're not actually paying for their services. I'm sure in this scenario, those companies will be delighted to step fully into the role of CA including accepting money for identity vouching. > In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with. No. The same couldn't apply to any company. My primary bank is online only. And how many times have you actually walked into an Amazon office? Or Paypal? Are people in Ohio supposed to fly to San Jose to get Paypal's public key when they create an account? Or are we going to wait for the post office to deliver a physical copy of Paypal's public key (and we'll just trust that whole transaction couldn't be compromised). Physical key exchange is simply not practical in most cases.

u801e 9y ago
It probably could apply to some that I locally deal with. But you're correct in saying that it's not practical for companies that don't have local branches.

greenhouse_gas 9y ago

>In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with. You could? Would your grandmother? Would you fly to Mountain View to get Google's? And then turn around and fly to Washington DC to get the IRS's? And then turn around and fly to who knows where to get HN's? And then tell them to keep customer staff ready to assist you to install their public keys? And what about personal blogs that don't want to be MITM?