4 ms·
I'm having a lot of trouble getting past: "Certificates bind a public key and an identity (commonly a DNS name) together." X.509 certificates bind a public key
by dvanduzer 13y ago
I'm having a lot of trouble getting past: "Certificates bind a public key and an identity (commonly a DNS name) together."
X.509 certificates bind a public key and a human recognizable string (a "common name") together to create a verifiable digital identity. Over-simplified, X.509 is about solving the "I'm Spartacus" problem.
CRLs solve the "He was Spartacus" problem. I agree with the broad conclusion that CRLs aren't effective for human trust, but they are perfectly reasonable for machine trust.
Why didn't the author mention Kerberos? The default lifetime of a Kerberos ticket is designed around humans: roughly the length of a work shift in front of a computer terminal.
final edit: meta-moderation is hard
- lnanek2 13y agoFor HTTPS to a web site, the common name is the site domain name. We're not talking about anything else here.
- dvanduzer 13y agoAha. That perhaps explains all the downvoting. But this was my objection: Name != Identity It's nearly impossible to have a meaningful English conversation about these problems without getting that straight.