3 ms·

It's protection money, no way to sugar coat it. It's not necessary, at all.

• MichaelGG 13y ago
  An untrusted cert looks identical to an attack. So the CA, while perhaps a circus, is necessary with current technology. Without that, there's no way to determine if you've been MITM'd or not - that's like the whole point of using TLS. I know there are other proposals, but within the current constraints of the "global PKI", there's no alternative. On a side note, for an EV cert, the CA must verify the registrant of the domain. They usually do a phone call to verify a phone number matching some other record with the name of the registrant. That takes some human effort to verify; more than an automated email. (In addition to just running a company, keeping a CA online but secure, etc.)
  • itistoday2 13y ago
    So the CA, while perhaps a circus, is necessary with current technology. With current technology, it is not necessary. Because of the blockchain (current tech) they serve absolutely no useful purpose. You cannot claim that because web browsers voluntarily choose not to use it that it somehow disqualifies it as current tech. Same goes for the EV cert and phone calls and all that jazz. Simply not necessary, and adds no extra value. In fact, it makes all of us less secure as the article points out. If, to take one of my favorite companies as an example, Mozilla were to support the blockchain for authentication, they would register themselves there, and that's that. No phone calls necessary, they simply own their identity, and can, via established existing channels (@mozilla twitter account, their newsletter, their .com, etc.) declare what is and isn't official. They can even get their .com into the blockchain, although that isn't yet current tech: http://forum.namecoin.info/viewtopic.php?f=5&t=1439 http://forum.namecoin.info/viewtopic.php?f=5&t=1439