4 ms·
Nobody seems to ask why should I trust DigiNotar or Verisign or whatever? I do not know them myself to trust them in the first place. So why should I trust them
by crististm 15y ago
Nobody seems to ask why should I trust DigiNotar or Verisign or whatever? I do not know them myself to trust them in the first place.
So why should I trust them through Mozilla? Or Google? I don't know enough to trust them either...
The whole pyramid trust scheme is broken.
- bzbarsky 15y agoIf you don't trust your browser, then you've already lost, since your browser ipso facto sees the unencrypted form of all your web traffic, both incoming and outgoing. Not only that, but it's running native code on your machine!
- crististm 15y agoI agree. That's why I go mostly with open software. If I care enough I'll go and get my hands dirty with code. However I trust open source because people _I know_ told me they are trust-able not because of a higher authority. I trust Amazon because friends of mine are satisfied customers and not because Verisign says so.
- bzbarsky 15y agoSure. But one important point here: Verisign doesn't tell you to trust Amazon. What Verisign can tell you is that you can trust that the server you're talking to right now is in fact affiliated with Amazon (in the case of EV certs) or corresponds to the hostname in your URL bar (in the case of regular certs). As long as no certificates got stolen, no one mis-issues certificates, etc....