3 ms·
people who want to push https everywhere, hello! what do you think about the false sense of security it provides ? what do you think about the turf wars betwee
by slim 3y ago
people who want to push https everywhere, hello!
what do you think about the false sense of security it provides ? what do you think about the turf wars between US tech oligarchs for gatekeeping your private life ?
- brador 3y agoAny secure alternative we should be looking into?
- cjbprime 3y agoWhy do you think it's a false sense of security? Are you familiar with Certificate Transparency? And Let's Encrypt?
- slim 3y agoObviously in this case people trusted Symantec, till they did not. In the mean time thousands of people probably got their computers compromised, and they are still compromised right now. When Google (an opponent) dared to speak out against Symantec, it took years, while people's security was still being compromised, before Microsoft removed the certificate. After removing the certificate, you'd think people are safe, but no Microsoft decided to silently reactivate it for an obscure reason for some time. Now my question is do you use MS Windows ? Do you feel safe, if microsoft can activate a compromised certificate at any time ? What certificate transparency are you talking about, if you have to trust handful of monopolistic companies ? Hierarchical trust is as good as it's trusted authorities. What would happen in the future if you find out that Let's encrypt certificates were compromised like Symantec ?
- cjbprime 3y agoSo the answer is no, you are unfamiliar with Certificate Transparency. You should check it out! It basically solved this problem a long time ago.
- hulitu 3y ago> Are you familiar with Certificate Transparency? You mean when Microsoft, Google, Apple, Cloudfare, Verisign, Digicert say "Trust me" ? Remember Crypto AG ?
- cjbprime 3y ago> You mean when Microsoft, Google, Apple, Cloudfare, Verisign, Digicert say "Trust me" ? No, because that's the opposite of the point of Certificate Transparency. When someone shares a technical term you haven't heard before, you could at least Google it, or ask ChatGPT to explain it, including explaining why it removes the need to trust large corporations to perform cert issuance correctly.
- mistrial9 3y agoupvote here - security is not the only consideration in a post-industrial civilization -- by requiring certificates at all times to publish on the open web, you have created a certificate authority that will expand and expand again. Secondly an "individual PC" will not be trusted to publish web content, it has to be from a "trusted" IP address, preferably cloudy with constant internal logging. This is already happening. Is the opposite better? zero certificates and any operator with any motive? no it is not better. Neither is better.. there have to be tradeoffs. safety != security != police-state