3 ms·
> TLS-only centralizes. It depends what you mean by centralizes. I can buy an SSL certificate from any number of companies. There has to be some initial root
by heurisko 5y ago
> TLS-only centralizes.
It depends what you mean by centralizes. I can buy an SSL certificate from any number of companies.
There has to be some initial root point of trust.
- Santosh83 5y ago> There has to be some initial root point of trust. For security critical web apps, this makes sense. For mere documents and simple sites without authentication or sensitive information, self-signed certificates should become acceptable, IMO.
- theandrewbailey 5y agoHow does a browser know which URLs are 'critical web apps' so that it can, if necessary, throw a big scary warning to the user? What stops a random website from self-identifying as critical (or not)? The S in HTTPS guarantees things. If those guarantees are loosened, that can cause bad problems.
- hulitu 5y agoDo you trust this root point ? Are you sure that the root is not compromised ? Because Google is saying so ?
- heurisko 5y agoMy root certificates are provided by a Debian package, not Google, so if I'm trusting anyone, I'm trusting them. (And their judgement of the root certificates). It's not unheard of, that root certs are revoked for unsecure behaviour. It seems like the system works to me. https://en.m.wikipedia.org/wiki/DigiNotar https://en.m.wikipedia.org/wiki/DigiNotar