3 ms·
SSL has various problems, mostly related to CAs. Also it is only easy to use because the server admin has done the hard part for you, therefor you have to trust
by jiggy2011 13y ago
SSL has various problems, mostly related to CAs.
Also it is only easy to use because the server admin has done the hard part for you, therefor you have to trust them.
To apply SSL to a cryptocat style system would require both parties to generate keys and somehow verify them, not so simple.
- tptacek 13y agoWhile I think SSL/TLS is "less secure" in some sense than GPG, which is fundamentally end-to-end, I still think SSL/TLS is a good system, if for no other reason than that it's the focus of a huge amount of research. The CA problems with HTTPS/TLS aren't fundamental to SSL/TLS. They're a consequence of browser UI. If you build your own software that uses TLS to make secure connections, you have a variety of options to avoid the browser CA problem; you can run your own CA (every instance of Burp Suite, the industry standard web pentest tool, does exactly that), or you can verify certificate fingerprints statically, or you can invent a new authentication system.
- jiggy2011 13y agoYes, that's a good point. However you are always somewhat reliant on a third party to do the security for you whether that is a CA or an app developer. That third party has to be trusted. It doesn't solve the fundamental problem of: Alice -> Bob without doing. Alice -> Facebook -> Bob Unless both alice and bob know how to generate and manage their own keys (and verify each others keys).
- tptacek 13y agoNo, also not true. You can use the TLS protocol to build a "web of trust" scheme just like GPG's out of self-signed certificates and key continuity.
- jiggy2011 13y agoRight, but web of trusts/PGP are inconvenient in a way that "look for the padlock icon" isn't. Which is likely why they are not in widespread use by the general populous.