8 ms·

It’s Time to Encrypt the Entire Internet

76 points by nodefan 12y ago

romanovcode 12y ago
Yet when I go to this link it's plain HTTP.
- l-p 12y ago
  It's actually worse than plain HTTP, requesting HTTPS redirects you to the plain HTTP version.
- AhtiK 12y ago
  Wired just got it wrong postfixing https instead of prefix :) http://www.wired.com/2014/04/https/ http://www.wired.com/2014/04/https/ But to stay on topic: encouraging this kind of major shift to SSL spreads a problem that is still there but is very little acknowledged or worked on -- revocations. Certificate revocation check is using either CRL or OCSP. CRL is a list of all the revoked certificates - browser needs to download the whole file and then check if the cert is revoked. OCSP is an optimized protocol to perform a more efficient certificate validation. CRL is slowly being phased out as it grows too fast and there are jokes around that thanks to heartbleed the size becomes comparable to a blockchain. But now the real issue: almost NONE of the mobile browsers check for revocation! Add to this that by default Chrome is not checking for cert revocation either. So isn't this rendering the whole revocation mechanism almost useless against a real attack? There is a reason why it's not done in mobile (and Chrome) -- it makes the requests slower, especially in mobile. There is a timeout fallback in browser so that whenever OCSP responder times out then browser assumes the cert is valid. Which is not helping when the real attack is executed. To sum up, until there is a 99% browser-market covering revocation mechanism that is not slowing down the browser CA-based SSL certificates are too fragile to get us to the safe and encrypted future.
  - claudius 12y ago
    However, it seems possible to explicitly use a secure browser (i.e. one that checks certificate revocations) if the need arises. You don’t need 99% browser-market coverage to allow people to securely connect to your site, nor do you need 99% browser-market coverage to securely connect to a given site. You only need that site to implement HTTPS, either with a self-signed cert and e.g. Certificate Patrol on your side or a CA-signed cert and a revocation-checking browser. In the latter case, you should also configure your browser to consider an OCSP failure an invalid certificate, not a valid one.
    - AhtiK 12y ago
      This all sounds good but at the same time only Firefox has OCSP Hard Fail feature (OCSP failure==invalid cert). Please correct me if it's still possible with others. Also user must become a rather paranoid person in order to start using a browser in mobile that supports hard fail OCSP. Getting HTTPS everywhere shouldn't mean promoting false sense of security. Considering that most HTTPS attacks require MITM it seems to me that OCSP without Hard Fail leaves attack vector wide open.
Infinitesimus 12y ago
Encrypting the internet is not enough if a few companies have unlimited resources and the freedom to figure out how to break the encryption (legally). *Edited for clarity
- swombat 12y ago
  False. What you say reduces the usefulness of encrypting everything but certainly doesn't make it "useless".
  - Infinitesimus 12y ago
    That's true, I misspoke. It does make it hard for the average joe hacker to get steal information, which is very valuable.
- ordinary 12y ago
  No company has unlimited resources, but what company, in your opinion, has enough resources at their disposal as well as an incentive to crack a fully encrypted Internet?
- TheLoneWolfling 12y ago
  Ah, the old "we can't stop everything so why bother trying" attack. (There's a better name for it but I cannot remember it) But a few points: - No company has unlimited resources. The universe doesn't have unlimited resources, AFAWK. - Even quantum computers can only take the square root of the complexity of many algorithms (Shor's algorithm). - Even if a company can, with concentrated effort, break the encryption used, it prevents (or at least drastically limits) mass surveillance. (If it costs your company a cent to decrypt a transmission, you'll decrypt a whole lot more than if it costs a million dollars per.)
swombat 12y ago
So perhaps this should start with a reduction in the cost of valid, "don't throw a security warning" certificates down to zero. At the moment the SSL certificate industry is one big ripoff fest...
- claudius 12y ago
  > So perhaps this should start with a reduction in the cost of valid, "don't throw a security warning" certificates down to zero. And then people will complain that the CA is not required to revoke certificates that it issued for free when their keys become compromised. What is people’s idea of DANE? DNSSEC adoption seems slow at the moment, but otherwise it appears to be a valid approach to this whole distributing-public-keys issue?
- dspillett 12y ago
  You mean like https://www.startssl.com/ https://www.startssl.com/? Their standard certificates are accepted by all major browsers released since 2010 (see http://en.wikipedia.org/wiki/Startssl#Trustedness http://en.wikipedia.org/wiki/Startssl#Trustedness) and are free for non-commercial use (I've heard claim of trouble with Windows Phone 7 devices but I've not had opportunity to check that myself). http://www.cacert.org/ http://www.cacert.org/ is another option, but their CA cert is generally trusted by default so it is no good for publicly targeted services.
  - Karunamon 12y ago
    You mean the one with a terrible user interface who charge 25$ to regenerate a cert? PKI is a scam and a racket.
    - dspillett 12y ago
      > PKI is a scam and a racket. The current implementation is far from perfect, but that is more than a tad strong. And it need not be as bad as it is, we just need to find the right changes to the process and get everyone to agree on them... Don't tar all PKI based solutions with the same overly large brush. > You mean the one with a terrible user interface I'll not disagree with you there. Though for free are you expecting perfection? It at least does the job. > who charge 25$ to regenerate a cert? Pro tip: backups. If you properly protect your keys and certificates you only need to pay if you need the old cert revoked (this is annoying if something beyond your control makes you need a full resign rather than a reissue, but things like heartbleed that necessitate this are hardly common).
y0ghur7_xxx 12y ago
The only problem I see with https everywhere is the current CA system. I don't trust CAs, and I don't want to pay them. If we can get rid of them somehow there is nothing in the way of https everywhere anymore. I really like the http://convergence.io/ http://convergence.io/ approach, but anything else that gets rid of a central authority I have to trust will do for me.
- userbinator 12y ago
  I don't trust CAs either but I use self-signed certificates when I want to collaborate securely online with people I know offline --- just give them a hardcopy of the certificate for them to verify and then add to their browser. It's unfortunate that newer browsers are making it harder to do this; I can see the justifications for this being in the name of "security", but can't help thinking that it's another way to keep the CAs happy in their monopoly over trust.
- zatkin 12y ago
  I'm wondering how well this scales. If you have thousands of upon thousands of people/companies that you trust, how do you ensure that they all remain trusted? What happens if you need to go through all of the certificates to ensure they can still be trusted?
- A_COMPUTER 12y ago
  Is convergence still running? I last tried it a couple years ago and the number of authorities dropped to three.
  - y0ghur7_xxx 12y ago
    Some say it's not dead¹. But it doesn't seem to have any traction, which is a shame. Perspectives is a similar project and seems more alive with a release in February: http://perspectives-project.org/2014/02/15/perspectives-4-4-released/ http://perspectives-project.org/2014/02/15/perspectives-4-4-... ¹https://twitter.com/ivanristic/status/400624593515192320 https://twitter.com/ivanristic/status/400624593515192320
plg 12y ago
It's time to decentralize the internet. There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines in our own homes (or some other place under our control). The current situation is akin to having to travel to some centralized letter-reading facility in order to read letter mail. Your grandma sends you a letter in the mail and you have to go to a central facility downtown, then prove your identity, and then they hand over the (opened) letter. We put a man on the moon more than 40 years ago. We must be able to sort this out.
- dspillett 12y ago
  > housed on our own machines in our own homes I for one do not want to be lumbered with maintaining my family's collection of micro services, making sure they are working OK, not compromised, and fully patched security-wise, and so forth. Its bad enough being expected to disinfect their laptops every other time the fail to follow my advice on being careful what they browse.
- rakoo 12y ago
  > There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines You know, this is exactly how the internet works, today. You can do it if you want. You will find that you're gonna have to spend some (some would say a lot of) time to amass enough knowledge to become self-sufficient. But there's no big technical issue, there only is a mindset issue. Do you actually want to spend the time, face downtimes and low speeds that having a real internet would incur, or do you want to remain in your comfy walled garden ? I'm sure what you really meant was "It's time to decentralize the services we use". > We put a man on the moon "We" as in "The government and countless private contractors, all with an unlimited budget", not as in "We the people". The centralization you see today is just the same thing.
- netcraft 12y ago
  This is an interesting idea, although as an alternative analogy: in an apartment complex, you would go down to your mailbox and insert a key to authenticate you to retrieve your mail. I think the biggest challenge to having on-premises software for all of this stuff is the maintenance of it - but a decentralized social media platform certainly sounds interesting.
AshleysBrain 12y ago
There's the obvious security/privacy point, but I think on a technical basis it would also be useful: the internet is full of pesky middleboxes which meddle with content, and this breaks things. For example, sometimes WebSockets can't connect unless run securely because somewhere a middlebox is looking at the content and changing it, expecting it to be HTTP traffic when really it's a websocket. Encryption removes the possibility for infrastructure-breaking middleboxes.
kryptiskt 12y ago
"Everything on the Internet should be strongly encrypted all the time." -- Bob Metcalfe (Infoworld 24 June 1996)
obeattie 12y ago
"That means secure connections to everything from your bank site to Wired.com to the online menu at your local pizza parlor." Oh, the irony that the article itself isn't served over HTTPS.
- sigzero 12y ago
  That's not really irony since it is proposing a possible "future".
rikacomet 12y ago
The question is better posed as "Can encryption put the morals of 'you know who' back in place?" As I see it encryption works against your average trouble maker. But the current wave essays that the data needs to be protected from even more people. Definitions like GOVERNMENT, CORPORATE, etc. Traditionally the GOVT needs that info to make macro-level decisions, so it was trusted by most people. CORPS on other hand could get that info, and the GOVT was supposed to regulate that process. Now it seems that the GOVT has gone beyond its neutral stance, but wait! it is actually not the GOVT, but the individuals at fault here. If you see this problem as something induced by corporate greed, than its possible to see this situation from a tech-security-guy-point-of-view as: The GOVT needs to keep all the windows safe from such greed, and the CORPS just need few windows to get inside, just like in Computer Security. Now join reality with this hypothesis, and ask yourself this: How many politicians fail to draw a line between: (1) cooperation (with CORPS) for "selfish" reasons (2) cooperation (with CORPS) for "democratic" reasons Now yes, historically many politicians have fallen prey to this type of thing, but up to what extent? You take succumb to it sometimes or regularly on a personal level? And yes, many corporate individuals/entities feel that they are at disadvantage if they don't cheat slightly, but does it stays within the self drawn line called "slightly/just a bit" or goes beyond it? At the end it becomes a chicken and egg problem. But is that really impossible to solve? Is the encryption alone or together with other things answer to this dilemma? And is it okay to sit at home, knowing you have the antidote to all the problems in the world, and let everyone outside "go to hell?" PS: Seemingly, the traditional 4th party: Elite evil hackers seems to be in line, thanks to a lot of people in US security structure working against them.
rakoo 12y ago
> You have to purchase TLS certificates from one of several certificate authorities I'd like to stop this misconception. You don't buy certificates. You make your own certificate, which is unknown to the world, and _then_ you buy a stamp from a trusted third-party on your own certificate, so everyone can trust it. The crux of the matter is whether you can actually trust these third-parties.
- rikacomet 12y ago
  The point is, which third parties to trust and for how long? How to be sure always that they are worthy of the continued trust?
- nly 12y ago
  That's not accurate. You send them a 'Certificate Signing Request', which is a request for them to issue you with a certificate. It's not a complete certificate template just lacking a signature. In any case... semantically a certificate isn't a certificate until it's been certified, it's just meaningless paper. In some ways this reminds me of the misconception about birth (and marriage) certificates from people new to genealogy. In the UK a birth certificate is just a piece of paper that contains markers of authentication to ensure people who read it can trust that it's true likeness of a record held at Her Majesty's GRO. It doesn't provide any guarantees about the honesty of data itself, or even if the person was ever born, in the same way me reading an x509 doesn't guarantee the data it contains is factual or was issued to the right person. Even if a CA does these checks, there's no way to insert a proof of such in to a certificate, therefore the certificate isn't such a proof...
einaros 12y ago
https://encrypt.today https://encrypt.today - who said the new TLDs were useless?
dobbsbob 12y ago
HTTP/2.0 is working on encrypting everything though NSA shills have managed to derail the working group by proposing "trusted proxies" that are allowed to decrypt traffic for nonsense optimization reasons.
- darkhorn 12y ago
  Will encryption be mandatory in HTTP2?
  - Zikes 12y ago
    It's central to the protocol, if I recall.
deleted 12y ago
[deleted]
- Jtsummers 12y ago
  OpenSSL != SSL. SSL/TLS are protocols with OpenSSL as one implementation.
- deleted 12y ago
  [deleted]
  - uuid_to_string 12y ago
    You are correct. They mentioned Heartbleed and the software that is responsible for it.
- nav1 12y ago
  I couldn't find a single mention of OpenSSL in the article. What are you talking about?
borplk 12y ago
For as long as the general population remains as computer illiterate as they are today no amount of encryption or decentrialising will save the internet. Despite its growing importance, the topic of computing is completely ignored at school. They teach the kids how to click on a few icons on Microsoft Word and Excel and PowerPoint, they graduate and become adults and think they know about computing. We have trained people to not learn anything of substance about computers, just click on this button, and push that button ... easy. There's only so far that stuff goes. When they teach you calculus, you don't turn around and tell the mathematicians "oh well ... just go make it easier for me this is not user-friendly". But with software no one is willing to take a single step towards learning some basic principles. So we end up making sacrifices because people can't be bothered with anything more complex than pushing this big green button right here. A better internet requires a population that understands some basic principles and is therefore willing to put some effort in protecting themselves.
AhtiK 12y ago
Here's my quick write-up on why encryption won't get us anywhere without a proper revocation mechanism (yes, it's 100% broken in the mobile). https://news.ycombinator.com/item?id=7604641 https://news.ycombinator.com/item?id=7604641

76 points by nodefan 12y ago

romanovcode 12y ago

Yet when I go to this link it's plain HTTP.

l-p 12y ago
It's actually worse than plain HTTP, requesting HTTPS redirects you to the plain HTTP version.
AhtiK 12y ago
Wired just got it wrong postfixing https instead of prefix :) http://www.wired.com/2014/04/https/ http://www.wired.com/2014/04/https/ But to stay on topic: encouraging this kind of major shift to SSL spreads a problem that is still there but is very little acknowledged or worked on -- revocations. Certificate revocation check is using either CRL or OCSP. CRL is a list of all the revoked certificates - browser needs to download the whole file and then check if the cert is revoked. OCSP is an optimized protocol to perform a more efficient certificate validation. CRL is slowly being phased out as it grows too fast and there are jokes around that thanks to heartbleed the size becomes comparable to a blockchain. But now the real issue: almost NONE of the mobile browsers check for revocation! Add to this that by default Chrome is not checking for cert revocation either. So isn't this rendering the whole revocation mechanism almost useless against a real attack? There is a reason why it's not done in mobile (and Chrome) -- it makes the requests slower, especially in mobile. There is a timeout fallback in browser so that whenever OCSP responder times out then browser assumes the cert is valid. Which is not helping when the real attack is executed. To sum up, until there is a 99% browser-market covering revocation mechanism that is not slowing down the browser CA-based SSL certificates are too fragile to get us to the safe and encrypted future.
- claudius 12y ago
  However, it seems possible to explicitly use a secure browser (i.e. one that checks certificate revocations) if the need arises. You don’t need 99% browser-market coverage to allow people to securely connect to your site, nor do you need 99% browser-market coverage to securely connect to a given site. You only need that site to implement HTTPS, either with a self-signed cert and e.g. Certificate Patrol on your side or a CA-signed cert and a revocation-checking browser. In the latter case, you should also configure your browser to consider an OCSP failure an invalid certificate, not a valid one.
  - AhtiK 12y ago
    This all sounds good but at the same time only Firefox has OCSP Hard Fail feature (OCSP failure==invalid cert). Please correct me if it's still possible with others. Also user must become a rather paranoid person in order to start using a browser in mobile that supports hard fail OCSP. Getting HTTPS everywhere shouldn't mean promoting false sense of security. Considering that most HTTPS attacks require MITM it seems to me that OCSP without Hard Fail leaves attack vector wide open.

Infinitesimus 12y ago

Encrypting the internet is not enough if a few companies have unlimited resources and the freedom to figure out how to break the encryption (legally). *Edited for clarity

swombat 12y ago
False. What you say reduces the usefulness of encrypting everything but certainly doesn't make it "useless".
- Infinitesimus 12y ago
  That's true, I misspoke. It does make it hard for the average joe hacker to get steal information, which is very valuable.
ordinary 12y ago
No company has unlimited resources, but what company, in your opinion, has enough resources at their disposal as well as an incentive to crack a fully encrypted Internet?
TheLoneWolfling 12y ago
Ah, the old "we can't stop everything so why bother trying" attack. (There's a better name for it but I cannot remember it) But a few points: - No company has unlimited resources. The universe doesn't have unlimited resources, AFAWK. - Even quantum computers can only take the square root of the complexity of many algorithms (Shor's algorithm). - Even if a company can, with concentrated effort, break the encryption used, it prevents (or at least drastically limits) mass surveillance. (If it costs your company a cent to decrypt a transmission, you'll decrypt a whole lot more than if it costs a million dollars per.)

swombat 12y ago

So perhaps this should start with a reduction in the cost of valid, "don't throw a security warning" certificates down to zero. At the moment the SSL certificate industry is one big ripoff fest...

claudius 12y ago
> So perhaps this should start with a reduction in the cost of valid, "don't throw a security warning" certificates down to zero. And then people will complain that the CA is not required to revoke certificates that it issued for free when their keys become compromised. What is people’s idea of DANE? DNSSEC adoption seems slow at the moment, but otherwise it appears to be a valid approach to this whole distributing-public-keys issue?
dspillett 12y ago
You mean like https://www.startssl.com/ https://www.startssl.com/? Their standard certificates are accepted by all major browsers released since 2010 (see http://en.wikipedia.org/wiki/Startssl#Trustedness http://en.wikipedia.org/wiki/Startssl#Trustedness) and are free for non-commercial use (I've heard claim of trouble with Windows Phone 7 devices but I've not had opportunity to check that myself). http://www.cacert.org/ http://www.cacert.org/ is another option, but their CA cert is generally trusted by default so it is no good for publicly targeted services.
- Karunamon 12y ago
  You mean the one with a terrible user interface who charge 25$ to regenerate a cert? PKI is a scam and a racket.
  - dspillett 12y ago
    > PKI is a scam and a racket. The current implementation is far from perfect, but that is more than a tad strong. And it need not be as bad as it is, we just need to find the right changes to the process and get everyone to agree on them... Don't tar all PKI based solutions with the same overly large brush. > You mean the one with a terrible user interface I'll not disagree with you there. Though for free are you expecting perfection? It at least does the job. > who charge 25$ to regenerate a cert? Pro tip: backups. If you properly protect your keys and certificates you only need to pay if you need the old cert revoked (this is annoying if something beyond your control makes you need a full resign rather than a reissue, but things like heartbleed that necessitate this are hardly common).

y0ghur7_xxx 12y ago

The only problem I see with https everywhere is the current CA system. I don't trust CAs, and I don't want to pay them. If we can get rid of them somehow there is nothing in the way of https everywhere anymore. I really like the http://convergence.io/ http://convergence.io/ approach, but anything else that gets rid of a central authority I have to trust will do for me.

userbinator 12y ago
I don't trust CAs either but I use self-signed certificates when I want to collaborate securely online with people I know offline --- just give them a hardcopy of the certificate for them to verify and then add to their browser. It's unfortunate that newer browsers are making it harder to do this; I can see the justifications for this being in the name of "security", but can't help thinking that it's another way to keep the CAs happy in their monopoly over trust.
zatkin 12y ago
I'm wondering how well this scales. If you have thousands of upon thousands of people/companies that you trust, how do you ensure that they all remain trusted? What happens if you need to go through all of the certificates to ensure they can still be trusted?
A_COMPUTER 12y ago
Is convergence still running? I last tried it a couple years ago and the number of authorities dropped to three.
- y0ghur7_xxx 12y ago
  Some say it's not dead¹. But it doesn't seem to have any traction, which is a shame. Perspectives is a similar project and seems more alive with a release in February: http://perspectives-project.org/2014/02/15/perspectives-4-4-released/ http://perspectives-project.org/2014/02/15/perspectives-4-4-... ¹https://twitter.com/ivanristic/status/400624593515192320 https://twitter.com/ivanristic/status/400624593515192320

plg 12y ago

It's time to decentralize the internet. There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines in our own homes (or some other place under our control). The current situation is akin to having to travel to some centralized letter-reading facility in order to read letter mail. Your grandma sends you a letter in the mail and you have to go to a central facility downtown, then prove your identity, and then they hand over the (opened) letter. We put a man on the moon more than 40 years ago. We must be able to sort this out.

dspillett 12y ago
> housed on our own machines in our own homes I for one do not want to be lumbered with maintaining my family's collection of micro services, making sure they are working OK, not compromised, and fully patched security-wise, and so forth. Its bad enough being expected to disinfect their laptops every other time the fail to follow my advice on being careful what they browse.
rakoo 12y ago
> There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines You know, this is exactly how the internet works, today. You can do it if you want. You will find that you're gonna have to spend some (some would say a lot of) time to amass enough knowledge to become self-sufficient. But there's no big technical issue, there only is a mindset issue. Do you actually want to spend the time, face downtimes and low speeds that having a real internet would incur, or do you want to remain in your comfy walled garden ? I'm sure what you really meant was "It's time to decentralize the services we use". > We put a man on the moon "We" as in "The government and countless private contractors, all with an unlimited budget", not as in "We the people". The centralization you see today is just the same thing.
netcraft 12y ago
This is an interesting idea, although as an alternative analogy: in an apartment complex, you would go down to your mailbox and insert a key to authenticate you to retrieve your mail. I think the biggest challenge to having on-premises software for all of this stuff is the maintenance of it - but a decentralized social media platform certainly sounds interesting.

AshleysBrain 12y ago

There's the obvious security/privacy point, but I think on a technical basis it would also be useful: the internet is full of pesky middleboxes which meddle with content, and this breaks things. For example, sometimes WebSockets can't connect unless run securely because somewhere a middlebox is looking at the content and changing it, expecting it to be HTTP traffic when really it's a websocket. Encryption removes the possibility for infrastructure-breaking middleboxes.

kryptiskt 12y ago

"Everything on the Internet should be strongly encrypted all the time." -- Bob Metcalfe (Infoworld 24 June 1996)

obeattie 12y ago

"That means secure connections to everything from your bank site to Wired.com to the online menu at your local pizza parlor." Oh, the irony that the article itself isn't served over HTTPS.

sigzero 12y ago
That's not really irony since it is proposing a possible "future".

rikacomet 12y ago

The question is better posed as "Can encryption put the morals of 'you know who' back in place?" As I see it encryption works against your average trouble maker. But the current wave essays that the data needs to be protected from even more people. Definitions like GOVERNMENT, CORPORATE, etc. Traditionally the GOVT needs that info to make macro-level decisions, so it was trusted by most people. CORPS on other hand could get that info, and the GOVT was supposed to regulate that process. Now it seems that the GOVT has gone beyond its neutral stance, but wait! it is actually not the GOVT, but the individuals at fault here. If you see this problem as something induced by corporate greed, than its possible to see this situation from a tech-security-guy-point-of-view as: The GOVT needs to keep all the windows safe from such greed, and the CORPS just need few windows to get inside, just like in Computer Security. Now join reality with this hypothesis, and ask yourself this: How many politicians fail to draw a line between: (1) cooperation (with CORPS) for "selfish" reasons (2) cooperation (with CORPS) for "democratic" reasons Now yes, historically many politicians have fallen prey to this type of thing, but up to what extent? You take succumb to it sometimes or regularly on a personal level? And yes, many corporate individuals/entities feel that they are at disadvantage if they don't cheat slightly, but does it stays within the self drawn line called "slightly/just a bit" or goes beyond it? At the end it becomes a chicken and egg problem. But is that really impossible to solve? Is the encryption alone or together with other things answer to this dilemma? And is it okay to sit at home, knowing you have the antidote to all the problems in the world, and let everyone outside "go to hell?" PS: Seemingly, the traditional 4th party: Elite evil hackers seems to be in line, thanks to a lot of people in US security structure working against them.

rakoo 12y ago

> You have to purchase TLS certificates from one of several certificate authorities I'd like to stop this misconception. You don't buy certificates. You make your own certificate, which is unknown to the world, and _then_ you buy a stamp from a trusted third-party on your own certificate, so everyone can trust it. The crux of the matter is whether you can actually trust these third-parties.

rikacomet 12y ago
The point is, which third parties to trust and for how long? How to be sure always that they are worthy of the continued trust?
nly 12y ago
That's not accurate. You send them a 'Certificate Signing Request', which is a request for them to issue you with a certificate. It's not a complete certificate template just lacking a signature. In any case... semantically a certificate isn't a certificate until it's been certified, it's just meaningless paper. In some ways this reminds me of the misconception about birth (and marriage) certificates from people new to genealogy. In the UK a birth certificate is just a piece of paper that contains markers of authentication to ensure people who read it can trust that it's true likeness of a record held at Her Majesty's GRO. It doesn't provide any guarantees about the honesty of data itself, or even if the person was ever born, in the same way me reading an x509 doesn't guarantee the data it contains is factual or was issued to the right person. Even if a CA does these checks, there's no way to insert a proof of such in to a certificate, therefore the certificate isn't such a proof...

einaros 12y ago

https://encrypt.today https://encrypt.today - who said the new TLDs were useless?

dobbsbob 12y ago

HTTP/2.0 is working on encrypting everything though NSA shills have managed to derail the working group by proposing "trusted proxies" that are allowed to decrypt traffic for nonsense optimization reasons.

darkhorn 12y ago
Will encryption be mandatory in HTTP2?
- Zikes 12y ago
  It's central to the protocol, if I recall.

deleted 12y ago

[deleted]

Jtsummers 12y ago
OpenSSL != SSL. SSL/TLS are protocols with OpenSSL as one implementation.
deleted 12y ago
[deleted]
- uuid_to_string 12y ago
  You are correct. They mentioned Heartbleed and the software that is responsible for it.
nav1 12y ago
I couldn't find a single mention of OpenSSL in the article. What are you talking about?

borplk 12y ago

For as long as the general population remains as computer illiterate as they are today no amount of encryption or decentrialising will save the internet. Despite its growing importance, the topic of computing is completely ignored at school. They teach the kids how to click on a few icons on Microsoft Word and Excel and PowerPoint, they graduate and become adults and think they know about computing. We have trained people to not learn anything of substance about computers, just click on this button, and push that button ... easy. There's only so far that stuff goes. When they teach you calculus, you don't turn around and tell the mathematicians "oh well ... just go make it easier for me this is not user-friendly". But with software no one is willing to take a single step towards learning some basic principles. So we end up making sacrifices because people can't be bothered with anything more complex than pushing this big green button right here. A better internet requires a population that understands some basic principles and is therefore willing to put some effort in protecting themselves.

AhtiK 12y ago

Here's my quick write-up on why encryption won't get us anywhere without a proper revocation mechanism (yes, it's 100% broken in the mobile). https://news.ycombinator.com/item?id=7604641 https://news.ycombinator.com/item?id=7604641