3 ms·
IMO, before http is deprecated, we need public key in DNS support, bypassing the CA system. It would possibly be a lower level of security than CA cert, but wou
by silon5 11y ago
IMO, before http is deprecated, we need public key in DNS support, bypassing the CA system. It would possibly be a lower level of security than CA cert, but would be good for many sites.
- danudey 11y agoThat's kind of the issue. There's basically two circumstances where I want to connect with a remote site: 1. I don't care who they are, I just want to read their content (any site I'm not going to log into, e.g. blog posts, etc) 2. I care who they are, I need to know they're them (banks, HN, Twitter, etc.) The current CA system provides the second one, but fundamentally it would be nice if, with the lack of a CA-verified certificate, the server/browser would just encrypt the connection anyway.
- zurn 11y agoTLS doesn't require CA. Browsers just decided they do, so they're rejecting any such https connections (anon DH and anon ECDH connections).