> It's hard to see it as a non-practical, academic idea when it's out there, deeply embedded in the internet, everywhere. It is non-practical, has no applicati

> It's hard to see it as a non-practical, academic idea when it's out there, deeply embedded in the internet, everywhere. It is non-practical, has no application in reality, and the direct consequence of using such a tool is massive security problems being disclosed every year. > Doesn't solve the problems X.509 addresses. What problem does X.509 address? Not only is it needlessly centralized, but your connection can be intercepted as long as one single CA anywhere is compromised. The "solution" to this is to log what certs each client got, reducing their privacy because this would allow us to detect when an attack happened, after it already happened (followed by a barrage of petty arguments like "w-well, it would disincentivize an attacker"). Also, a domain name that sounds kind of like the company you want to connect to is not proof that you have the right domain name. You still have to ask them for the right domain name, at which point you may as well have just received their public key. The alternative is to do this dog shit thing you guys keep doing where you complain about Google search not being regulated enough and enact more ad-hoc laws many of which backfire. Imagine search engines having to do work to find the "real" domain for some company. This is 10th level stupidity, we could not have got here without several other generations of stupidity becoming normalized prior.