3 ms·

Yeah, TLS solves that right? So we can agree that a decentralized system effectively removes the need to ever trust any third party system?

• StavrosK 6y ago
  Of course not. You didn't write all the code yourself, even if you did make your own CA and removed all other CAs from your computer (or did you? Because they can MitM you if you didn't). You still have to trust the people who wrote the code to have done so correctly and non-maliciously, plus the people who wrote the OS, and the computer, and everything. It's a much smaller leap to go from "I trust you to have written the code correctly" to "I also trust you to run the server well" than it is to go from "I don't trust anything" to "I trust all these billions of lines of code I didn't write".
• hiq 6y ago
  TLS is not decentralized in its common form, you just use a certificate signed by a third-party (CA). So you end up trusting this CA. Why are you willing to trust this CA instead of Signal's server? If you self-sign a certificate instead, how do I check that the signature matches yours? To get a (proper) secure channel, you need at least an authenticated channel first.