I think the whole Web PKI needs a do-over, and it can't happen soon enough.
I think the whole Web PKI needs a do-over, and it can't happen soon enough. I work in software security and design security solutions for and with competent customers. In the past couple of years (post Snowden), every design for every one of these customers have been with the assumption that the CA model is broken and can't be trusted - this is a big step. Personally I find the Wildcard SSL certificate a particularily ugly hack for the broken state of the web PKI. Ideally, I should be able to get my own site certificate and use that to sign the server certificates for all my services in my domain. The beauty of this is that my site's private key does not need to be on any on my exposed servers, and I can revoke and re-issue certs for servers individually. This does ofcourse not work, since the certificates aren't limited to domains as such, which correctly is pointed out is a glaring flaw of the entire system. I'm not going to rant about ASN.1 - let's do that another time.
Posted by janvidar on May 15, 2015, 2:29 PM
Tags
Related issues
- You obviously did this for fun, I don’t want to throw any shade on it and have no criticism, I also make fun things just because.¹ So ta...
- Many devs love to shit on the guy from the 'I just want the exe.
- Now imagine how poor people stress if their smartphone bricks or gets damaged or lost.
- Resuming an extended-thinking session fails permanently with 400 "thinking blocks cannot be modified" (transcript stores thinking text as empty but keeps signat
- I'll preface this with a statement that as a European I want European alternatives to succeed, and MS-owned GitHub to shrivel and disappear.
- Yeah, but there’s a world of difference between “not perfect” and “we rounded a few sliders, and now the modal is a nightmare to use”.
Raise real-world problems, find people facing the same issue, and discuss solutions.6,500 issues0 comments
reliability (SaaS)
You obviously did this for fun, I don’t want to throw any shade on it and have no criticism, I also make fun things just because.¹ So ta...
NewMany devs love to shit on the guy from the 'I just want the exe.
Now imagine how poor people stress if their smartphone bricks or gets damaged or lost.
Resuming an extended-thinking session fails permanently with 400 "thinking blocks cannot be modified" (transcript stores thinking text as empty but keeps signat
I'll preface this with a statement that as a European I want European alternatives to succeed, and MS-owned GitHub to shrivel and disappear.
Yeah, but there’s a world of difference between “not perfect” and “we rounded a few sliders, and now the modal is a nightmare to use”.
I used to write a lot of native Windows corporate software in the 90's and 2000's and my standard login window was a floating draggable o...
App broken with Mosquitto broker 7.0.0
I think the whole Web PKI needs a do-over, and it can't happen soon enough.
I think the whole Web PKI needs a do-over, and it can't happen soon enough. I work in software security and design security solutions for and with competent customers. In the past couple of years (post Snowden), every design for every one of these customers have been with the assumption that the CA model is broken and can't be trusted - this is a big step. Personally I find the Wildcard SSL certificate a particularily ugly hack for the broken state of the web PKI. Ideally, I should be able to get my own site certificate and use that to sign the server certificates for all my services in my domain. The beauty of this is that my site's private key does not need to be on any on my exposed servers, and I can revoke and re-issue certs for servers individually. This does ofcourse not work, since the certificates aren't limited to domains as such, which correctly is pointed out is a glaring flaw of the entire system. I'm not going to rant about ASN.1 - let's do that another time.
Comments (0)
No comments yet. Start the discussion.