3 ms·
> Fourth, the SSL cert industry became corrupt. OV standards were never very high, and EV standards started slipping. Then there was the Cloudflare problem. Clo
by crooked-v 5y ago
> Fourth, the SSL cert industry became corrupt. OV standards were never very high, and EV standards started slipping. Then there was the Cloudflare problem. Cloudflare is a certificate authority, and they issue certs to themself for domains which run through Cloudflare. So looking up a cert just gets Cloudflare's info.
Tying SSL certs to identity (rather than just to verification that someone has the authority over a given domain) was a dumb idea in the first place, so I hardly see a problem with workarounds in that regard.
- bryanrasmussen 5y agowell not for the problem of security, but for their problem of trying to identify who is actually behind a site it of course is a problem that the ties to identity became weaker. on edit: yes, they want to verify identity because their purpose is really to provide a form of security as well, so it is sort of removed by a step / nothing works all the way down, getting confusing at this point.
- Animats 5y agoMy metric is, "if you needed to sue the website operator, could you find them?"