6 ms·

Why is HTTPS "rather a joke"? Genuinely curious...

• ekimekim 11y ago
  Because your client (generally a browser) is configured to implicitly trust a group of companies called "root Certificate Authorities" (root CAs). Now, consider one such company head-quartered in China, or the US. The governments of both countries have the power to secretly demand such a company's keys, then use them to make your client trust whichever endpoint they chose.
  • eli 11y ago
    That's still considerably better than sending unencrypted HTTP over the wire in pretty much every way.
    • stefantalpalaru 11y ago
      Better, but not good enough.
• mirimir 11y ago
  The security model is broken, just like BGP's is. Root CAs plainly can't be trusted. It's not just that they'll cooperate with governments. See "Security Collapse in the HTTPS Market".[0] [0] http://queue.acm.org/detail.cfm?id=2673311 http://queue.acm.org/detail.cfm?id=2673311