12 ms·
Having things encrypted is good, yes, but requiring people to get a certificate means that the web has fewer chokepoints, which is bad. IMHO, SSL ought to use
by e1ven 14y ago
Having things encrypted is good, yes, but requiring people to get a certificate means that the web has fewer chokepoints, which is bad.
IMHO, SSL ought to use a fingerprint-comparison check, instead of a central cert. "This server has changed since last time. Is that OK?"
- blaenk 14y agoWhat about the first time the user connects, how would they be assured that the fingerprint really is the site's and not a man in the middle? Honest question, myself being pretty new to cryptography.
- e1ven 14y agoIn theory, you could do an out-of-band comparison. In practice, you'd generally accept that the first one you receive is valid, and then watch for deviations from there. This is the way SSH works, for instance.
- X-Istence 14y agohttp://www.imperialviolet.org/2011/06/16/dnssecchrome.html http://www.imperialviolet.org/2011/06/16/dnssecchrome.html Using DNSSEC we can host the fingerprint of the cert in DNS at which point an CA is not required.
- caf 14y agoHow is that a question that any end-user could be expected to answer with any kind of authority?