3 ms·
It is to the network operator. And anyone that has compromised the operator by any imaginable means, including whatever star chamber forces the operator to han
by topspin 8y ago
It is to the network operator. And anyone that has compromised the operator by any imaginable means, including whatever star chamber forces the operator to hand it over.
- zamadatix 8y agoThe same is true of any endpoint trust relation, including that of certificates for HTTP/2. That you can't fully trust anyone but yourself isn't an argument for less security.
- ecnahc515 8y agoCertificates allow for decentralized trust, we just rely on a centralized CA. If we didn't trust the central CAs, we could still all run our own CIs and trust individuals. Whether that's actually something anyone would do is different, but technologically, https allows for not trusting anyone but yourself and the organization your speaking to.
- Spooky23 8y agoEnd of the day, even CA compromise is failure evident in most cases. If you're worried about nation-state actors, the risk is really defects in key negotiation. With mobile standards, the technology is fundamentally such a joke that people come up with wonky technical reasons to avoid talking about the political problems. We probably offer better security for sporting event feeds than we do for critical communications infrastructure.