3 ms·

Is there something about a chain of trust people don't understand? A chain of trust doesn't mean a commercial body, as that implies that being commercial makes

Is there something about a chain of trust people don't understand? A chain of trust doesn't mean a commercial body, as that implies that being commercial makes it more trustworthy. It means any individuals or groups you can trust, not those your browser maker or software developer includes in their software in the belief that they are trustworthy. Why should relationships with faceless commercial entities whose employees you have no personal acquaintance with take precedence over people known to you believe you can trust? Why shouldn't individuals be capable of forming the same trust networks that companies do, and what methods do companies use in forming their chains of trust that individuals can't emulate, as companies themselves depend on individual human beings to create their systems? Did you overlook the last paragraph in the article? The way the browser vendors, Mozilla being one of the bad guys, notify users about untrusted certificates is a major culprit. They state that the certificate is not trusted, or something to that effect, when in fact they mean that the certificate is not recognized in their trust network.

dspillett 12y ago
> A chain of trust doesn't mean a commercial body Correct, but it does mean entities that are qualified to be trusted on the matter. I don't trust a lot of my contacts (both personal or commercial) to be good people for judging what is safe/legit/secure. How many times I've heard an otherwise technically competent individual complain at being laughed at for using "but <other_person> give me the link I assumed it was OK" as part of their defence when taken the mick out of for getting infected by malware from some ropey website/app/whatever is something it would scare me to count. > Why shouldn't individuals be capable of forming the same trust networks that companies do You can. The current system does allow this, though I'll admit not at all intuitively for the general public. Create your own CA keys, have contacts include them in their trust stores. Build a web of trust by signing each others keys (or passing them between each other and new contacts via secure channels). > They state that the certificate is not trusted, or something to that effect, when in fact they mean that the certificate is not recognized in their trust network. From their PoV those two thing are the same. Things I have no reason to trust are not things I can guarantee are trustworthy. In security there is unfortunately no room for granting the "benefit of the doubt".

dspillett 12y ago

> A chain of trust doesn't mean a commercial body Correct, but it does mean entities that are qualified to be trusted on the matter. I don't trust a lot of my contacts (both personal or commercial) to be good people for judging what is safe/legit/secure. How many times I've heard an otherwise technically competent individual complain at being laughed at for using "but <other_person> give me the link I assumed it was OK" as part of their defence when taken the mick out of for getting infected by malware from some ropey website/app/whatever is something it would scare me to count. > Why shouldn't individuals be capable of forming the same trust networks that companies do You can. The current system does allow this, though I'll admit not at all intuitively for the general public. Create your own CA keys, have contacts include them in their trust stores. Build a web of trust by signing each others keys (or passing them between each other and new contacts via secure channels). > They state that the certificate is not trusted, or something to that effect, when in fact they mean that the certificate is not recognized in their trust network. From their PoV those two thing are the same. Things I have no reason to trust are not things I can guarantee are trustworthy. In security there is unfortunately no room for granting the "benefit of the doubt".