Practically nothing you said is correct.
Practically nothing you said is correct. * CAs were implemented to issue and verify digital certificates, not verify a connection. No part of TLS PKI is intended to verify that you are connecting to the same service everyone else is. PKI (and CAs) are intended to assure identity , as well as providing a secure connection over a public network. When you buy a Papa Johns pizza, we know we're not all buying our pizza from the exact same Papa Johns store. But we do know it's a Papa Johns. * SSH does do your second example, but TLS PKI does not. As the above example points out, there is more than one Papa Johns store, just as there is more than one web server or service around the globe providing the same organization's data. SSH assumes there is only one Papa Johns store that serves all Papa Johns pizzas; one host is tied to one host key signature. PKI does not make this assumption. * Blockchains are a stupid idea because they require access to a global public network. Depending on DNS to issue and verify digital certificates is like using SMTP/POP3 to 'simplify' the authentication of users when distributing web downloads. TLS PKI does not require access to a network, nor receiving any updates from it, and its software is designed to be secure by default, unlike DNS, which in many operating systems cannot be secure by design (because they don't provide a verifying stub resolver, besides the inherent security problems in the protocol's design). Honestly, most of the suggestions people have to replace PKI just reduces reliability without providing particularly improved security. The biggest problem with PKI is the uncertainty of ensuring the security of such a high number of CAs. That's easy enough to solve... have less CAs and make them more transparent.
Posted by peterwwillis on Oct 27, 2014, 7:56 PM
Tags
Related issues
- That's the biggest problem with iOS because Apple can be ordered to block them from the App Store and it would be instantly kill these pr...
- I'm intrigued about the "Trip Planner" being a top-level app.
- This asymmetry is IMO the biggest problem with AI-driven output.
- This is one of the most important objectives in software today.
- At least in Europe - these rouge corporations need to be reined in or just leave the market.
- I was skeptical, but this looks genuinely useful.
Raise real-world problems, find people facing the same issue, and discuss solutions.9,000 issues0 comments
hackernews (SaaS)
That's the biggest problem with iOS because Apple can be ordered to block them from the App Store and it would be instantly kill these pr...
I'm intrigued about the "Trip Planner" being a top-level app.
This asymmetry is IMO the biggest problem with AI-driven output.
This is one of the most important objectives in software today.
At least in Europe - these rouge corporations need to be reined in or just leave the market.
I was skeptical, but this looks genuinely useful.
Why has she gone through so many iPhones?
The biggest problem with Europe is the lack of innovation.
Practically nothing you said is correct.
Practically nothing you said is correct. * CAs were implemented to issue and verify digital certificates, not verify a connection. No part of TLS PKI is intended to verify that you are connecting to the same service everyone else is. PKI (and CAs) are intended to assure identity , as well as providing a secure connection over a public network. When you buy a Papa Johns pizza, we know we're not all buying our pizza from the exact same Papa Johns store. But we do know it's a Papa Johns. * SSH does do your second example, but TLS PKI does not. As the above example points out, there is more than one Papa Johns store, just as there is more than one web server or service around the globe providing the same organization's data. SSH assumes there is only one Papa Johns store that serves all Papa Johns pizzas; one host is tied to one host key signature. PKI does not make this assumption. * Blockchains are a stupid idea because they require access to a global public network. Depending on DNS to issue and verify digital certificates is like using SMTP/POP3 to 'simplify' the authentication of users when distributing web downloads. TLS PKI does not require access to a network, nor receiving any updates from it, and its software is designed to be secure by default, unlike DNS, which in many operating systems cannot be secure by design (because they don't provide a verifying stub resolver, besides the inherent security problems in the protocol's design). Honestly, most of the suggestions people have to replace PKI just reduces reliability without providing particularly improved security. The biggest problem with PKI is the uncertainty of ensuring the security of such a high number of CAs. That's easy enough to solve... have less CAs and make them more transparent.
Comments (0)
No comments yet. Start the discussion.