2 ms·
The same way you know if you should trust the WebPKI Rube-Goldberg-contraption: you don't. It's a counterexample, not a recommendation. If you need this guara
by octoberfranklin 1y ago
The same way you know if you should trust the WebPKI Rube-Goldberg-contraption: you don't.
It's a counterexample, not a recommendation.
If you need this guarantee, use self-certifying hostnames like Tor *.onion sites do, where the URL carries the public key. More examples of this: https://codeberg.org/amjoseph/not-your-keys-not-your-name https://codeberg.org/amjoseph/not-your-keys-not-your-name
- akerl_ 1y agoI trust the WebPKI infra quite a bit. Cert validation is publicly logged, CAs that do nefarious things get booted from browser trust stores. I can set which CAs can sign certs for my domains, and monitor if any are issued that I didn't expect.