3 ms·
CAs need to go away. They’re untrustworthy and their inclusion in browsers and OSes seems largely unregulated.
by wang_li 1y ago
CAs need to go away. They’re untrustworthy and their inclusion in browsers and OSes seems largely unregulated.
- ignaciovdk 1y agoThat’s a sentiment I hear a lot, and honestly, not without reason. The trust model behind public CAs is… fragile at best. Misissuances, opaque root store politics, and uneven auditing make it feel like we’re outsourcing security to a cartel. But until there’s a widely adopted alternative (DANE, peer-to-peer trust, Web of Trust 2.0?), we’re stuck maintaining vigilance within this system. And unfortunately, the shorter cert lifecycles and increasing complexity only make that harder.