4 ms·

I'm surprised no one here is talking about Namecoin [1]. It has become obvious that the PKI system is failing, and the main issue is centralization. I don't kn

I'm surprised no one here is talking about Namecoin [1]. It has become obvious that the PKI system is failing, and the main issue is centralization. I don't know if Namecoin itself will be the solution, or some other blockchain-based method that achieves decentralization such as the more generic Ethereum [2], but as engineers we should be supportive of such systems, as they provide better security and true -not just delegated- domain name ownership. [1] http://namecoin.info/ http://namecoin.info/ [2] https://www.ethereum.org/ https://www.ethereum.org/

M2Ys4U 12y ago
>It has become obvious that the PKI system is failing, and the main issue is centralization. Actually, the problem is exactly the opposite. Any CA can sign a certificate for any domain. What compounds the problem with the CA system is that CA trust is sticky. When a new CA gets added to trust stores, they are effectively trusted for life. That's not how trust actually works. What we need is a system that is distributed and that allows for trust to be granted and - most importantly - revoked at will without causing collateral damage (i.e. for innocent sites that end up using a bad CA). Moxie Marlinspike's convergence[0] was a great idea, but it's never really taken off. TACK[1], also by Marlinspike, looks like nice feature to help transition away from the CA system when we come up with something better. [0] http://convergence.io/ http://convergence.io/ [1] http://tack.io/ http://tack.io/