2 ms·

Glad I read HN. Why isn't this checked by default?

• tptacek 13y ago
  Because it doesn't work; it's a double bind: either you hard-fail on revocation checks, in which case users can lose connectivity if they happen to not have connectivity to the CA (as in the captive portal case, or with broken proxy/cache servers), or you allow the user to connect anyways, in which case attackers can simply override the revocation check. It also involves you telling a CA which sites you're visiting.
  • takeda 13y ago
    Why are we not using DNS for this?
    • tptacek 13y ago
      Using DNS for what? CAs? Are you asking "why don't we take the crappy PKI we have right now and just give it to the world's governments"?