3 ms·
> It comes with a lot of PKI for free to help address the "how do you know you can trust the other guy on the line?" I would hesitate to trust a high stakes sy
by loup-vaillant 7y ago
> It comes with a lot of PKI for free to help address the "how do you know you can trust the other guy on the line?"
I would hesitate to trust a high stakes system (like, controlling a regional power grid) with TLS's default PKI. There are hundreds of certificate authorities out there, all of which can vouch for everything. Compromising one certificate authority is enough to mount a man in the middle attack.
Granted, this is not a trivial attack, and TLS as it is now is mostly sufficient for your regular online shopping. More critical applications however need a dedicated PKI.
- munchbunny 7y agoAbsolutely, which is why I included the extra point: If you want the client/server to trust a restricted list of servers/clients, most clients and servers have that capability. If you are running a regional power grid, TLS as a technology is still fine, but you should absolutely not trust the default PKI.
- loup-vaillant 7y agoOops, missed that, sorry.