5 ms·

Like most (all?) digital products, the price of SSL certificates will converge to zero with higher usage. So mass adoption might be beneficial after all.

zobzu 14y ago
I believe the Internet should stay free, and making your own website should certainly stay free. Right now, you don't have to have a domain. You don't have to pay for a SSL certificate. You don't have to pay for hosting. The only thing actually need you pay for is the link to the ISP. And it's not like there weren't better, free alternatives either. Ultimately it's not about the price tag. It's about having a third party controlling your stuff. It's more about freedom than free as in beer.
- JoachimSchipper 14y ago
  It took me a minute to figure out that "what do you mean, not free? Surely wordpress will just buy a *.wordpress.com certificate?" was not what you're going for.
  - zobzu 14y ago
    Well yeah, unless you own *.wordpress.com, the certificate and domain belongs to wordpress.com, not you. You're in their hands.
- Firehed 14y ago
  Then continue using HTTP/1.1. SSL needs to verify the site's identity to be effective, period. For a certain level of trust (EV certs, for example) that requires humans doing work, at least for now. Humans cost money. StartSSL's free certs work perfectly well for non-EV requirements, which basically amount to a verification level of "someone who can read email on this domain has requested a cert for it" - which can be, and is, completely automated and therefore available for free.
  - zobzu 14y ago
    That reply is wrong on so many levels. First of all, everyone wants the benefits of HTTP/2.0, obviously. Else I'd be using gopher, thank you very much. Then, startssl is a company, that happens to give free certs. For one single sub-domain. Got two subdomains? Gotta pay. They can also decide to make those non-free at any given moment, if they feel like it. The only part I agree with, is paying for EV certificates. But you should NOT need to pay and you should NOT need a third party to be responsible for YOUR certificates if you do not want to. And again, there's quite a few distributed trust models around that work well and do exactly that, but get great push back from vendors, since, by nature, they don't bring as much money back.
danielweber 14y ago
Some sites, like embedded products that are shipped to customers, are not compatible with the forced-SSL model at all. If my fridge has a webserver I need to be able to talk with it.
- selectnull 14y ago
  I understand the pain of deploying SSL with shrink wrapped software, but that should not be a reason for us to just say "oh f... it, let's just talk to our devices using plain text and adopt hope as our new security model". My original statement still stay, with mass adoption of SSL we will have new challenges and will find new solutions.
  - danielweber 14y ago
    but that should not be a reason for us to just say "oh f... it, let's just talk to our devices using plain text and adopt hope as our new security model". That sounds to me like the exact solution you are proposing. If I'm selling lightbulbs with webservers built-in in an "only SSL signed by a CA" universe, I can only let people talk to it with plaintext and hope no one breaks in. Right now I can sell lightbulbs with built-in webservers that people can talk to secretly. And with TACK I could keep someone from dropping in on me.

zobzu 14y ago

I believe the Internet should stay free, and making your own website should certainly stay free. Right now, you don't have to have a domain. You don't have to pay for a SSL certificate. You don't have to pay for hosting. The only thing actually need you pay for is the link to the ISP. And it's not like there weren't better, free alternatives either. Ultimately it's not about the price tag. It's about having a third party controlling your stuff. It's more about freedom than free as in beer.

JoachimSchipper 14y ago
It took me a minute to figure out that "what do you mean, not free? Surely wordpress will just buy a *.wordpress.com certificate?" was not what you're going for.
- zobzu 14y ago
  Well yeah, unless you own *.wordpress.com, the certificate and domain belongs to wordpress.com, not you. You're in their hands.
Firehed 14y ago
Then continue using HTTP/1.1. SSL needs to verify the site's identity to be effective, period. For a certain level of trust (EV certs, for example) that requires humans doing work, at least for now. Humans cost money. StartSSL's free certs work perfectly well for non-EV requirements, which basically amount to a verification level of "someone who can read email on this domain has requested a cert for it" - which can be, and is, completely automated and therefore available for free.
- zobzu 14y ago
  That reply is wrong on so many levels. First of all, everyone wants the benefits of HTTP/2.0, obviously. Else I'd be using gopher, thank you very much. Then, startssl is a company, that happens to give free certs. For one single sub-domain. Got two subdomains? Gotta pay. They can also decide to make those non-free at any given moment, if they feel like it. The only part I agree with, is paying for EV certificates. But you should NOT need to pay and you should NOT need a third party to be responsible for YOUR certificates if you do not want to. And again, there's quite a few distributed trust models around that work well and do exactly that, but get great push back from vendors, since, by nature, they don't bring as much money back.

danielweber 14y ago

Some sites, like embedded products that are shipped to customers, are not compatible with the forced-SSL model at all. If my fridge has a webserver I need to be able to talk with it.

selectnull 14y ago
I understand the pain of deploying SSL with shrink wrapped software, but that should not be a reason for us to just say "oh f... it, let's just talk to our devices using plain text and adopt hope as our new security model". My original statement still stay, with mass adoption of SSL we will have new challenges and will find new solutions.
- danielweber 14y ago
  but that should not be a reason for us to just say "oh f... it, let's just talk to our devices using plain text and adopt hope as our new security model". That sounds to me like the exact solution you are proposing. If I'm selling lightbulbs with webservers built-in in an "only SSL signed by a CA" universe, I can only let people talk to it with plaintext and hope no one breaks in. Right now I can sell lightbulbs with built-in webservers that people can talk to secretly. And with TACK I could keep someone from dropping in on me.