4 ms·

So basically a brave new word where google will decide what is a good and a bad website. Great.

• onion2k 7y ago
  My preferred solution would be an open API standard that companies could use to provide independent information about domains, that browsers could use to pull data about domains, and that companies who index the web could use to update whether or not they trust domains. That way anyone could set up as a source of information about whether or not a domain is trustworthy. I'm not in a position to actually do it though, and Google are (for themselves, without sharing the API), so for now that's the best we've got. Maybe someone who has the resources to compete with Google will step up.
  • chii 7y ago
    > open API standard that companies could use to provide independent information about domains ... anyone could set up as a source of information about whether or not a domain is trustworthy. and how is a user supposed to know who to trust for this information, if there are multiple sources? At the root, the problem is one of verification - that who you are communicating with is who they claim to be. At some level, there needs to be trust in one entity as a definitive source (that the site you're looking at is indeed created by the business that the site is claiming to be representing). There has to be some level of trust somewhere...
    • onion2k 7y ago
      and how is a user supposed to know who to trust for this information, if there are multiple sources? They could choose the provider they trust most. Which, for the majority, would probably be Google.
• drivingmenuts 7y ago
  We're already there - what we really need is for Google to back the hell off some of their gatekeeping decisions.
• amfsn 7y ago
  That's what they wanted when they pushed Let's Encrypt. https meant something before, since a certificate was expensive and required proof of identity. Yes, those methods weren't infallible, but they were good enough. Now we've lost that with free https.
  • cm2187 7y ago
    EV certs required that. DV certs never provided that sort of security.
    • amfsn 7y ago
      Of course they did. When you paid with your card they knew your identity. Unless you were carding which is a pretty serious crime.
      • logifail 7y ago
        > When you paid with your card they knew your identity. Who's the "they" in that sentence? As it stands, a certificate reseller knows that the Paypal account "some.name.here@gmail.com" paid for a SSL certificate for "www.unrelatedcompany.TLD" The certificate itself tells you nothing about who paid for it - it doesn't even tell you which email account was used to confirm some level of association with the unrelatedcompany.TLD domain.
        • amfsn 7y ago
          Then PayPal has the data and LE can follow the trail. Because it's about LE being able to tell who actually bought the certificate, telling me end users can't do that is kinda moving the goalposts.
          • pilsetnieks 7y ago
            There are certificate authorities all over the world, and many of them not in jurisdictions that would share data with your law enforcement.