4 ms·
Is it folly to continue with https given that the certificate authority tree of trust has been compromised? Maybe baby steps are a good option, but I'd like to
by ENGNR 13y ago
Is it folly to continue with https given that the certificate authority tree of trust has been compromised?
Maybe baby steps are a good option, but I'd like to eventually see all traffic signed with keys stored in a distributed ledger like namecoin. Good on the IETF for moving forward though.
- DavidHogue 13y agoThere are degrees of brokenness with SSL. Even if certificate authorities are compromised by major governments, SSL is still enough for now to keep my credit card safe from the shady guy in the back corner of the coffee shop. Or to keep my Google searches private from the techies at my ISP. There are some upcoming workaround that will help too like cert pinning or DANE.
- yeukhon 13y agoThere are issues with trusting CA in PKI, but you have to recognized that this is still a good model. What we have to worry about is insider and protecting contract integrity. There are other ways Google can collect statistics and there are items Google don't need and absolutely have no use. In the past people discovered Motorola collecting/logging http requests you are making and this is the kind of things Google should not collect. Protecting whether a malware has been installed in Google's server or a hub is attached at AT&T network room are all necessary things to do. In any case, if PKI trust model is broken, then nothing can be trusted. Decentralized network relies on a degree of trust in the software developers and the hardware engineers.