3 ms·

Who are "they"? Google? Mozilla? Microsoft? Apple? The 100s of CAs? And, are they all working together? And there hasn't been a single whistleblower to expose t

Who are "they"? Google? Mozilla? Microsoft? Apple? The 100s of CAs? And, are they all working together? And there hasn't been a single whistleblower to expose this? What do you mean "listen"? CAs can invalidate certs at will, but, they have no mechanism to listen on communications (unless you give them your private key, but, then anyone you give your private key to can eavesdrop). The CA system has lots of issues. It would be a pretty big conspiracy if there were thousands of people that knew of something better and said nothing. But, there is absolutely no proof that anyone has any idea how to do better than the CA system. Do you know of such a system or have any evidence that someone else does? Google, despite their flaws w.r.t. privacy, has done quite a bit of work to improve the CA situation - Certificate Transparency, for example.

posterboy 8y ago
> Who are "they"? A court seizing a domain thereby invalidating a cert. > What do you mean "listen"? If I accept a custom cert, but don't validate the key, I might as well use none, basically. That's the extent of my knowledge, I don't know what Certificate Transparency is doing, for example. > The CA system has lots of issues. It would be a pretty big conspiracy if there were thousands of people that knew of something better and said nothing. But, there is absolutely no proof that anyone has any idea how to do better than the CA system. Do you know of such a system or have any evidence that someone else does? > It would be a pretty big conspiracy Exactly, so why do you expect that twitter sized post could it explain it convincingly? > if there were thousands of people that knew of something better and said nothing Ironically, it might be the ability to censor communication to suppress such voices, however hypothetical that is, that triggered the GP. > But, there is absolutely no proof that anyone has any idea how to do better than the CA system. PGP is used with key exchange in real live. I'm not using it, just arguing for the sake of the argument. It has problems, too, but "better" is not a binary value , except in the limited scope of the specific problem. PGP doesn't need root CAs.

posterboy 8y ago

> Who are "they"? A court seizing a domain thereby invalidating a cert. > What do you mean "listen"? If I accept a custom cert, but don't validate the key, I might as well use none, basically. That's the extent of my knowledge, I don't know what Certificate Transparency is doing, for example. > The CA system has lots of issues. It would be a pretty big conspiracy if there were thousands of people that knew of something better and said nothing. But, there is absolutely no proof that anyone has any idea how to do better than the CA system. Do you know of such a system or have any evidence that someone else does? > It would be a pretty big conspiracy Exactly, so why do you expect that twitter sized post could it explain it convincingly? > if there were thousands of people that knew of something better and said nothing Ironically, it might be the ability to censor communication to suppress such voices, however hypothetical that is, that triggered the GP. > But, there is absolutely no proof that anyone has any idea how to do better than the CA system. PGP is used with key exchange in real live. I'm not using it, just arguing for the sake of the argument. It has problems, too, but "better" is not a binary value , except in the limited scope of the specific problem. PGP doesn't need root CAs.