6 ms·

I get the "i hate Twitter/elon" attitude, but the truth is that the CA system has been dependent on pay-to-verify for some time now and despite whatever grievan

I get the "i hate Twitter/elon" attitude, but the truth is that the CA system has been dependent on pay-to-verify for some time now and despite whatever grievances you have against verisign or whoever it's brought us to today safely enough.

commandersaki 4y ago
The pay-to-verify is the reason why a significant chunk of the Internet didn't have HTTPS. It was the inception of free CAs like Lets Encrypt that made 90+% HTTPS penetration.
- xeromal 4y ago
  I'd argue laziness is the reason most of the internet didn't have HTTPS. Browsers putting a scary checkmark next to the site is what made it happen.
joe_the_user 4y ago
And the problem with pay for identity is you can buy other people's identities. The news was full impersonations right after Twitter initiated it's pay for blue check marks. That we don't here about it now may just be a matter that the news stopped caring. URL squatting was a problem for a long time - the decision that trademark holder could seize domains helped but a web address today isn't considered a solid identity at this point so "the system working" is a bit of an exaggeration. Also, I'd note the gp didn't bad-mouth Elon or Verisign so your comment is a kind of riding a trolly false accusation.
giaour 4y ago
I think the problem was not that Twitter started charging $8/month ago much as that they gave up the expensive-to-perform ID verification workflow that had been in place. The CA system, on the other hand, has more or less abandoned the expensive, manual "extended verification" process in favor of the zero marginal cost "domain verification" process. This switchover drove the cost of a new cert to $0 for almost all users. So I'm really not following your analogy, since Twitter gave up the workflow and started charging (aka, a cash grab), whereas CAs gave up charging and adopted a more efficient workflow (aka the expected behavior of efficient markets).
- biztos 4y ago
  Maybe Twitter Blue was a cash grab, but for me as a light user (and not a Blue) it’s way more transparent and sensible now. “Paid account with extra features” is just far easier to parse than “someone at Twitter thinks this person/company is both authentic and important.”
  - platz 4y ago
    100%
  - cachvico 4y ago
    But now (with Twitter) I can't trust anything I read without double-checking carefully it is not a fake account (and even then I cannot be sure). At least beforehand I was able to trust that Twitter has done the basic KYC. The Meta implementation therefore seems smarter (depends on gov ID).
    - throwntoday 4y ago
      Why did you ever trust anything on twitter without double-checking? Consider how much misinformation you have processed over the years because of too much faith in a platform to disseminate facts over fiction.
      - libraryatnight 4y ago
        I don't think he's talking about the information in the tweets, but the source. If I'm a fan of X and I go find X on twitter, I used to be able to more or less trust that X with a blue checkmark was the twitter account representing X. Before the hilarious shift to the gold marks, it was a lot of sifting through stupid meme accounts. People were doing verified accounts for my ISP support twitter that day, lol
      - bugbuddy 4y ago
        If we accept the logic that we should not trust anything posted by anyone on Twitter, then Twitter would no longer be a viable source of information whatsoever. Do you see the problem? It is poisoning the well.

commandersaki 4y ago

The pay-to-verify is the reason why a significant chunk of the Internet didn't have HTTPS. It was the inception of free CAs like Lets Encrypt that made 90+% HTTPS penetration.

xeromal 4y ago
I'd argue laziness is the reason most of the internet didn't have HTTPS. Browsers putting a scary checkmark next to the site is what made it happen.

joe_the_user 4y ago

And the problem with pay for identity is you can buy other people's identities. The news was full impersonations right after Twitter initiated it's pay for blue check marks. That we don't here about it now may just be a matter that the news stopped caring. URL squatting was a problem for a long time - the decision that trademark holder could seize domains helped but a web address today isn't considered a solid identity at this point so "the system working" is a bit of an exaggeration. Also, I'd note the gp didn't bad-mouth Elon or Verisign so your comment is a kind of riding a trolly false accusation.

giaour 4y ago

I think the problem was not that Twitter started charging $8/month ago much as that they gave up the expensive-to-perform ID verification workflow that had been in place. The CA system, on the other hand, has more or less abandoned the expensive, manual "extended verification" process in favor of the zero marginal cost "domain verification" process. This switchover drove the cost of a new cert to $0 for almost all users. So I'm really not following your analogy, since Twitter gave up the workflow and started charging (aka, a cash grab), whereas CAs gave up charging and adopted a more efficient workflow (aka the expected behavior of efficient markets).

biztos 4y ago
Maybe Twitter Blue was a cash grab, but for me as a light user (and not a Blue) it’s way more transparent and sensible now. “Paid account with extra features” is just far easier to parse than “someone at Twitter thinks this person/company is both authentic and important.”
- platz 4y ago
  100%
- cachvico 4y ago
  But now (with Twitter) I can't trust anything I read without double-checking carefully it is not a fake account (and even then I cannot be sure). At least beforehand I was able to trust that Twitter has done the basic KYC. The Meta implementation therefore seems smarter (depends on gov ID).
  - throwntoday 4y ago
    Why did you ever trust anything on twitter without double-checking? Consider how much misinformation you have processed over the years because of too much faith in a platform to disseminate facts over fiction.
    - libraryatnight 4y ago
      I don't think he's talking about the information in the tweets, but the source. If I'm a fan of X and I go find X on twitter, I used to be able to more or less trust that X with a blue checkmark was the twitter account representing X. Before the hilarious shift to the gold marks, it was a lot of sifting through stupid meme accounts. People were doing verified accounts for my ISP support twitter that day, lol
    - bugbuddy 4y ago
      If we accept the logic that we should not trust anything posted by anyone on Twitter, then Twitter would no longer be a viable source of information whatsoever. Do you see the problem? It is poisoning the well.