4 ms·
> I think it is a best practise. I agree that it would make things more secure if it were a best practise. However, it is currently not. Nobody actually does i
by rlpb 13y ago
> I think it is a best practise.
I agree that it would make things more secure if it were a best practise. However, it is currently not. Nobody actually does it, and I think you'd be fighting an unwinnable uphill battle to change this.
If you're going to fight this, you might as well deprecate the CA system as best practice while you're at it. Does this sound unlikely? The same problem applies to asking websites to publish a suitable warning.
And how would you securely broadcast such a warning, anyway?
- pasbesoin 13y agoI do it, for sites that particularly concern me. For example, it's been... interesting, to watch the ongoing changes in Google's cert chains. And when, many months ago, I commented on these, I received a number of silent (no comment) upvotes. If you're not looking at the whole chain, you're ripe for MITM, particularly with the cruft in default root certificate distributions as well as ongoing changes in entity alliances -- whether free or coerced.