4 ms·

I think this is a really good example of how the ssl CA system is fundamentally broken.

by arpstick 12y ago

syntaxgoonoo 12y ago
Please explain?
- itistoday2 12y ago
  See my reply next to your comment. Also: "Neither self-signed nor CA-signed certificates are securely authenticated, so the padlock is completely misleading." From: https://news.ycombinator.com/item?id=7826503 https://news.ycombinator.com/item?id=7826503
  - gnopgnip 12y ago
    This system is very inefficient. So inefficient that it would not be useable on mobile devices, and you would have to trust a 3rd party to verify websites for you. >Neither self-signed nor CA-signed certificates are securely authenticated CA-signed certs are authenticated by the certificate authority. You cannot trust that a website presenting itself as google, is google, without any prior information. But google can get a certificate issued by a ca, and you can trust the ca. Why do you think ca signed certs are not securely authenticated?
    - itistoday2 12y ago
      > This system is very inefficient. So inefficient that it would not be useable on mobile devices, and you would have to trust a 3rd party to verify websites for you. It sounds like you're thinking about running a blockchain node locally. DNSChain is exactly fixing that issue. It is even more efficient than the current system. > A-signed certs are authenticated by the certificate authority. Incorrect, CA-signed certs are authenticated by any certificate authority. > Why do you think ca signed certs are not securely authenticated? Your answer is in the link that I posted. Here it is again: https://news.ycombinator.com/item?id=7826503 https://news.ycombinator.com/item?id=7826503
itistoday2 12y ago
"Oh thank you Namecheap for giving us even cheaper pay-for-insecurity certificates!" Kinda sad. We deserve a better internet than this. Use the blockchain for free and actually secure certificates: https://github.com/okTurtles/dnschain https://github.com/okTurtles/dnschain

I think this is a really good example of how the ssl CA system is fundamentally broken.

syntaxgoonoo 12y ago

Please explain?

itistoday2 12y ago
See my reply next to your comment. Also: "Neither self-signed nor CA-signed certificates are securely authenticated, so the padlock is completely misleading." From: https://news.ycombinator.com/item?id=7826503 https://news.ycombinator.com/item?id=7826503
- gnopgnip 12y ago
  This system is very inefficient. So inefficient that it would not be useable on mobile devices, and you would have to trust a 3rd party to verify websites for you. >Neither self-signed nor CA-signed certificates are securely authenticated CA-signed certs are authenticated by the certificate authority. You cannot trust that a website presenting itself as google, is google, without any prior information. But google can get a certificate issued by a ca, and you can trust the ca. Why do you think ca signed certs are not securely authenticated?
  - itistoday2 12y ago
    > This system is very inefficient. So inefficient that it would not be useable on mobile devices, and you would have to trust a 3rd party to verify websites for you. It sounds like you're thinking about running a blockchain node locally. DNSChain is exactly fixing that issue. It is even more efficient than the current system. > A-signed certs are authenticated by the certificate authority. Incorrect, CA-signed certs are authenticated by any certificate authority. > Why do you think ca signed certs are not securely authenticated? Your answer is in the link that I posted. Here it is again: https://news.ycombinator.com/item?id=7826503 https://news.ycombinator.com/item?id=7826503

itistoday2 12y ago

"Oh thank you Namecheap for giving us even cheaper pay-for-insecurity certificates!" Kinda sad. We deserve a better internet than this. Use the blockchain for free and actually secure certificates: https://github.com/okTurtles/dnschain https://github.com/okTurtles/dnschain