5 ms·

Heartbleed knocked us down, the CA system is going to make it very difficult for us to stand up straight again - that's the point.

• wmf 13y ago
  How much effort would it be to rebuild a web of trust after all the keys were simultaneously assumed compromised?
  • jerf 13y ago
    Well, that's one of the most powerful arguments in favor of CAs I've ever heard.
  • lorddoig 13y ago
    Good point, but will it be less than all the effort and money about to be expended in the coming months? Who knows. For the record I did say that PGP may not be the solution. The other great thing is that PGP is not just for sites but for people, so even if all the private keys handled by nginx/apache/whatever were compromised Heartbleed-style, the core person-to-person trust relationships would be unaffected; the core of the web of trust would be intact, only the endpoints would need re-verified.
    • politician 13y ago
      That's a great point worth repeating. Your personal trust relationships probably don't also change when your bank gets hacked and needs to replace their keys, and a network of a certain size will restore access to your bank relatively quickly due to friend of a friend connections. It also reduces the burden on your bank for maintaining the security of their keys (to some extent). It's still very important, but the consequences are no longer quite so catastrophic.
  • Sae5waip 13y ago
    That's precisely why you only use subkeys in daily life and only use the root key for keysigning (and ideally store it safely and offline).