3 ms·
the EFF could run a site that would provide trustworthy pinned keys for arbitrary sites on the Internet, and you could subscribe to that site. So how do you kn
by itistoday2 13y ago
the EFF could run a site that would provide trustworthy pinned keys for arbitrary sites on the Internet, and you could subscribe to that site.
So how do you know that your subscription to EFF is secure?
Contrast to DNSChain, which requires that ordinary users trust a third-party server.
First-party, not third-party. What you described with EFF is a third-party, whereas DNSChain is a first (or 2nd) party, because either you own the server (1st party), or your friend does (2nd? party).
DNSChain isn't going to happen.
It's already happened. I'm using it right now. Where's TACK?
- tptacek 13y agoYou're playing semantic games with "first party" and "second party" and "third party". If I didn't think EFF was trustworthy, I wouldn't subscribe. Key continuity would still make TACK valuable; even without trusted third parties, widespread deployment of TACK would practically eradicate dragnet surveillance through compromised CAs, because every attempt to forge a certificate would quickly be detected.
- itistoday2 13y agoYou're playing semantic games I am not. Those words have real meaning that doesn't disappear when you accuse me of playing semantic games. If I didn't think EFF was trustworthy, I wouldn't subscribe. I asked how do you _know_? With DNSChain, you actually have a great deal of certainty that is based on math, not public reputation. widespread deployment of TACK would practically eradicate dragnet surveillance through compromised CAs, because every attempt to forge a certificate would quickly be detected. With DNSChain there are no compromised CAs to eradicate, and therefore no problem. You also get to keep your money, no more need to pay for SSL certificates.
- tptacek 13y agoOk, you have fun with that.