"authentication of the content, not the connection" Popular websites that hold themselves out as businesses, i.e. "exclusive" sources of content (often generat

"authentication of the content, not the connection" Popular websites that hold themselves out as businesses, i.e. "exclusive" sources of content (often generated by users, go figure), they have no reason to support this concept. Because then it does not matter where the user gets the content. But they might have reasons to support TLS. One could argue users want authentic content (signed content), not authentic "websites" (single sources for content trying to serve too many users, all at the same time). Or maybe many users do not know the difference? Van Jacobsen gave a good talk on this at Google: http://www.youtube.com/watch?v=8Z685OF-PS8 http://www.youtube.com/watch?v=8Z685OF-PS8 There is another thread on the HN front page right now about a Blackhat conference talk on x86 CPUs. There is another talk on that page about how TLS relies on the trustworthiness of internet routing. What is the point of securing connections when you have no control over routing? Instead of relying on securing "connections", I think schemes that send out "encrypted blobs" with the hope they arrive at the proper destination make more sense. Encrypting blobs is not something for which an "authority" is needed. This is something over which the user can retain full control without involving third parties. As it should be. TLS might have encryption that works well enough to "secure a connection" but if I am not mistaken it still has no reliable way to verify an endpoint (recipient) is the one you want it to be. Some people call that "authentication". I'm not even sure that TLS can reliably perform "authentication of the connection" as Fielding states. For that, I think SSH is a better protocol.