IssueRaiser

because web-of-trust-models worked so great for PGP/GPG.

because web-of-trust-models worked so great for PGP/GPG. In theory that's great, but how can I confirm that the cert in the chain is indeed for google.com. Because it's trusted by chrome which I downloaded from google.com (or at least a machine pretending to be google.com) or because my computer-illiterate friends trust it? Or because my OS trusts that cert? I agree that the current system is broken, but I fail to see how a distributed system magically fixes this, most notably the issue of bootstrapping trust. I foresee that the distributed model moves to a more centralized model where we trust apple, microsoft, ubuntu.

Posted by Xylakant on Apr 2, 2015, 11:07 AM

Tags

Related issues

Raise real-world problems, find people facing the same issue, and discuss solutions.7,500 issues0 comments

reliability (Other)

because web-of-trust-models worked so great for PGP/GPG.

XylakantApr 2, 2015, 11:07 AM

because web-of-trust-models worked so great for PGP/GPG. In theory that's great, but how can I confirm that the cert in the chain is indeed for google.com. Because it's trusted by chrome which I downloaded from google.com (or at least a machine pretending to be google.com) or because my computer-illiterate friends trust it? Or because my OS trusts that cert? I agree that the current system is broken, but I fail to see how a distributed system magically fixes this, most notably the issue of bootstrapping trust. I foresee that the distributed model moves to a more centralized model where we trust apple, microsoft, ubuntu.

Comments (0)

No comments yet. Start the discussion.

Comment on this issue