3 ms·
HTTPS is certainly a better option than no HTTPS. But we shouldn't forget that its trust model it is fundamentally and irrecoverably broken -- it has hundreds
by ctz 14y ago
HTTPS is certainly a better option than no HTTPS. But we shouldn't forget that its trust model it is fundamentally and irrecoverably broken -- it has hundreds of single points of complete failure (to wit, DigiNotar and Comodo who both silently and completely broke HTTPS for the entire internet, for a time).
So, for the short term -- HTTPS is the best we have. In the medium term, the security model of HTTPS (and by implication, SPDY) must die, and CAs along with it. DANE or Convergence seem like good replacements. Convergence certainly has the right trust model. DANE is perhaps more easy to migrate to, but suffers from being built on DNSSEC's unacceptably shitty crypto infrastructure.
- sliverstorm 14y agoReading about Convergence, it sounds like it hardly does away with the security model of HTTPS. Best I can tell, it's just HTTPS & multiple CAs, as compared to today's HTTPS & single CA. Nothing wrong with that, but you speak of getting rid of CAs- it doesn't seem like Convergence does that.
- gizmo686 14y agoA remember hearing a talk about a half solution to the broken model of HTTPS that could be done with the existing system, which was either a proposol or being implenented. The idea was that when you establish an HTTPS connection to a new site, you save their certificate for a certain amount of time. In the future when you log in, if the certificate they provide dissagrees with the one you have then you assume it is compromised. Becuase of the obvious promblem of legitimatly changing certificates there was a mechanism for the server to inform you of that, but this requires active participation by the server, so the entire system is only done if the server explicitly enables it. In the long term, we need to replace HTTPS entirely.