5 ms·

Google Chrome strongly advises you not to continue. If you click the "Advanced" link, you can, though. Who decided that a centralized entity could be the auth

Google Chrome strongly advises you not to continue. If you click the "Advanced" link, you can, though. Who decided that a centralized entity could be the authority for these things, anyway, instead of a Web of Trust? And also, should the books "1984" and "Fahrenheit 451" be required reading in British schools?

api 12y ago
"Who decided that a centralized entity could be the authority for these things, anyway, instead of a Web of Trust?" Usability. Try explaining to a non-technical person how to bootstrap their trust system. Things either "just work" or they are broken, at least for 99% of users. I'd even count myself as part of that group. I'm a highly technical user, but I'm usually too busy to futz around with stuff. I get something akin to road rage when stuff doesn't work and get out of the way. I played a lot with stuff when I was younger but I don't have time for that crap anymore.
- vegardx 12y ago
  The problem is that we're mixing encryption and authentication in one bag. Somehow we've managed to teach every non tech-savvy users to be more scared of a self-signed certificate than browsing the very same page unencrypted.
  - hdevalence 12y ago
    Secure communications require encryption AND authentication. Full stop. You can't unmix them.
- lectrick 12y ago
  > Try explaining to a non-technical person how to bootstrap their trust system. It can be automated. There are many examples now of headless networks- Bitcoin, Bittorrent, etc. A browser could connect to such a network, and when connecting to a server, could verify how many signatures from other parties have signed the certificate from that server. Then, this information could be cached, as long as the public key stayed the same. The process would have to be renewed for any new domain connected to via HTTPS, though. From an administration standpoint, the domain holder would just have to request that a certain number of existing entities sign their cert. Maybe they could pay them a nominal fee to cover the admin task. Admittedly, it took me years to come around to understanding this stuff (which is, essentially, public-private key encryption and digital signatures, and where "trust" comes from, and reading about PGP/GPG) to enough of a degree that the existing system started to not make much sense to me. I believe Namecoin (http://namecoin.info/ http://namecoin.info/) tried to solve this problem using Bitcoin blockchain tech, but they appear to be WAY before their time. Using their tech, I believe that both domain name management as well as certificate generation and signing could be automated.
driverdan 12y ago
This is because they use an SSL cert that is signed using a cert not included with browsers (or at least not included with Chrome).

api 12y ago

"Who decided that a centralized entity could be the authority for these things, anyway, instead of a Web of Trust?" Usability. Try explaining to a non-technical person how to bootstrap their trust system. Things either "just work" or they are broken, at least for 99% of users. I'd even count myself as part of that group. I'm a highly technical user, but I'm usually too busy to futz around with stuff. I get something akin to road rage when stuff doesn't work and get out of the way. I played a lot with stuff when I was younger but I don't have time for that crap anymore.

vegardx 12y ago
The problem is that we're mixing encryption and authentication in one bag. Somehow we've managed to teach every non tech-savvy users to be more scared of a self-signed certificate than browsing the very same page unencrypted.
- hdevalence 12y ago
  Secure communications require encryption AND authentication. Full stop. You can't unmix them.
lectrick 12y ago
> Try explaining to a non-technical person how to bootstrap their trust system. It can be automated. There are many examples now of headless networks- Bitcoin, Bittorrent, etc. A browser could connect to such a network, and when connecting to a server, could verify how many signatures from other parties have signed the certificate from that server. Then, this information could be cached, as long as the public key stayed the same. The process would have to be renewed for any new domain connected to via HTTPS, though. From an administration standpoint, the domain holder would just have to request that a certain number of existing entities sign their cert. Maybe they could pay them a nominal fee to cover the admin task. Admittedly, it took me years to come around to understanding this stuff (which is, essentially, public-private key encryption and digital signatures, and where "trust" comes from, and reading about PGP/GPG) to enough of a degree that the existing system started to not make much sense to me. I believe Namecoin (http://namecoin.info/ http://namecoin.info/) tried to solve this problem using Bitcoin blockchain tech, but they appear to be WAY before their time. Using their tech, I believe that both domain name management as well as certificate generation and signing could be automated.

driverdan 12y ago

This is because they use an SSL cert that is signed using a cert not included with browsers (or at least not included with Chrome).