4 ms·
Yes, if you own the device, you can choose what to trust beyond valid cert requirements. To answer your question, yes, I do consider TLS end-to-end despite invo
by move-on-by 8y ago
Yes, if you own the device, you can choose what to trust beyond valid cert requirements. To answer your question, yes, I do consider TLS end-to-end despite involvement of a 3rd party. I believe certificate transparency has removed a lot of the trust issues around CAs that previously existed. Trust is no longer required when there is public verifiable logs. Also, with the trend moving towards short cert lifespans, the risk of certs being stolen and used against you is more difficult- requiring regular updates. I hope to see the max cert validity periods become shorter and shorter
- badrabbit 8y agoThat's ridiculous. The popular CAs are not part of the TLS standard and neither is CT. Plenty of intranet TLS with intetnal CAs. CTs are good if the end client only uses root CAs that participate. Let's say CT solves the server authentication issues,how does does the server authenticate the client? End to end means both parties authenticate,TLS supports client authnetication but a) DNS over HTTPs isn't doing that b) even if it did there isn't CT for client certs...