3 ms·

> HTTPS can be implemented in a decentralized way How does that work? AFAIK there is always a root authority.

• nicce 5y ago
  Keys can be exchanged without root authority. Root authority is only required for identifying that website owner is who he claims to be.
  • xyzzyz 5y ago
    Yes, and without verifying that the owner is who he claims to be, exchanging keys is not of much value.
    • c22 5y ago
      I dunno, knowing the owner hasn't changed since last time seems almost as good.
• erikerikson 5y ago
  No. There are roots and you can install any root you like including one you create. Is that some amount of centralization? I don't think so though convenience and efficiency encourage it on a single and not very important dimension. Once a CA signs a cert they are no longer involved in the HTTPS protocol and really that's the bulk of the use case. As GP noted, it certainly includes "without a single party having access to your sites visited".
  • soraminazuki 5y ago
    You can install any root you like as long as your device lets you. TVs are less likely to let you install your own root.