3 ms·
We're just gonna keep patching holes in the PKI design instead of admitting it doesn't really work, I guess.
by ocdtrekkie 4y ago
We're just gonna keep patching holes in the PKI design instead of admitting it doesn't really work, I guess.
- tialaramex 4y agoDoes "the PKI design" here mean specifically the Web PKI? Or do you mean Public Key Infrastructure in general? For PKI in general, you don't have any actual choice. This is actually why the Web PKI exists. SSL was originally conceived with no PKI, but upon analysis there's a trust problem. Why is this the right key? If I have no reason to believe it's the right key, Mallory can MITM me, the protocol achieved very little of value. So that's why there's the web PKI. If you don't like how the Web PKI works, it seems to me that improvements (of which there have been a great many in the 20+ years I've cared about it) are exactly "patching holes in the design" and so, yeah, duh, of course that's what we are going to do.