4 ms·
> You're right to say that the PKI doesn't work if you just want to trust any site that shows a padlock in the address bar, but it's useful if you do a little w
by darkarmani 12y ago
> You're right to say that the PKI doesn't work if you just want to trust any site that shows a padlock in the address bar, but it's useful if you do a little work.
Not it isn't. It still suffers from not respecting name constraints. You can't setup trust for only a list of domains. If i run my own CA for some list of domains, there is no way i can prevent my CA from being able to sign for google.com. Instead people use wildcard certs so they can be delegated responsibility for a subdomain.
- mike_hearn 12y agoYou can get a certificate for a fixed list of domains. If name constraints were implemented more widely, that'd be great. But someone has to write the code, debug it, ship it, etc, and then you have to wait until lots of people have upgraded, etc, and ultimately wildcard certs work well enough.
- darkarmani 12y ago> If name constraints were implemented more widely, that'd be great. But someone has to write the code, debug it, ship it Without name constraints I assert the system is inherently broken. You cannot limit trust other than yes/no. > ultimately wildcard certs work well enough. Well enough is arguable. The problem is that your attack surface grows with each machine rather than having a private key per machine.