> By design, certificate authorities need to be 1.

> By design, certificate authorities need to be 1. trustworthy, 2. highly vetted and 3. very few. If everyone is a certificate authority, then no one is. Isn't that the situation we are in now? All it takes is one CA with poor security cough Diginotar cough and the whole system is broken. I'm obviously ignoring the fact we have CRLs - but if someone has a signed cert for say chase.com or google.com they can do a lot of damage in a very little amount of time. Maybe I'm just cynical that there is a profit motive to CAs. I mean, you can't tell me that it's just greed that you can purchase a certificate to turn a user's address bar green because it's "extended validated". The average user won't notice, or even know what that means. Big picture behavior - there is no functional difference between a EV and non-EV signed certificates. My opinion: if we keep the SSL/CA system the way it is today - we need fewer CAs but create non-profit CAs where the average person can get CA signed/trusted certificate for free or next to free. I'm not talking about grabbing some random dude off the street and start a non-profit - it should be funded and sponsored by companies like Google/Verisign/Microsoft etc.

Posted by nadams on Feb 2, 2015, 4:11 AM

Tags

• reliability (Other)

Related issues

• This is my biggest problem with agents, they constantly defensively code for cases that have no chance of happening and in most cases a p...
• I wish there was something like LEAN for biology.
• The issue is really the extreme difficulty of programming them, especially for anything sequential (rather than combinatorial).
• I probably could have beared with it if it was only limited to programming, but it showing up in creative fields has made me feel all sor...
• I hate that I'm in deep enough to know what you mean.
• The biggest problem with “AI” is that big corps are shoving it down our throats.