31–40 of 255 posts
letsencrypt is great and I use it. But I don't really get it. All I needed to do was prove that I could place a generated file on the server that I wanted the certificate for. This seems to me to be a very low bar. What am I missing?
In the past, the bar used to be much higher.
Whether a lower bar is a good idea or not I will leave to other more informed folk.
SSL is fundamentally broken. Web-of-trust is the only real way to do security.
Yes, SSL has been broken for some time. That's why TLS was introduced nearly 20 years ago.
[1] This is the sort of lazy mistake I would make, because I'm not a security expert.
Earlier quoted context omitted.
Yes, SSL has been broken for some time. That's why TLS was introduced nearly 20 years ago.
You presumably got downvoted for being pedantic here, but I think your pedantry is reasonable. If someone's going say "X is fundamentally broken", they should know what X is actually called. Referring to TLS as SSL reeks of amateur hour and shallow knowledge[1], and is a mistake on par with referring to Javascript as Java. [1] This is the sort of lazy mistake I would make, because I'm not a security expert.
Earlier quoted context omitted.
It's not. It's actually worse. You're assuming that random people on the internet are going to collectively be more secure than CAs, which is obviously not the case. Imagine you get an email signed by the IRS, and which is trusted by people A1, A2 and A3, who are trusted by people B1, B2, and B3 ... who are trusted by Z1, Z2, and Z3, who are fully trusted by you. Should be reliable, right? But while Z1, Z2 and Z3 may…
All you've told me is you don't understand web-of-trust.
Earlier quoted context omitted.
I think the real sentiment here is: good PKI is an unsolved (and perhaps unsolvable) problem.
True. But at least web-of-trust gives you the ability to do something you are comfortable with.
SSL is fundamentally broken. Web-of-trust is the only real way to do security.
I think the real sentiment here is: good PKI is an unsolved (and perhaps unsolvable) problem.
I think a real solution would be something like a multi-root, score-based system (e.g. if the U.S. government, Underwriters Laboratories & ICANN all state that I'm talking to www.google.com/172.217.13.238, then I honestly probably am) — but I'm worried that it'd be way too complex for normal people.
SSL is fundamentally broken. Web-of-trust is the only real way to do security.
SSL is not fundamentally broken. The server authentication process is. Besides what does web-of-trust add? The client usually does not authenticate himself to the server. How should a client share "hey, I trust this server" with others?
We have natural experiments showing that WoT, at least as implemented, doesn't scale. I hate that humans don't seem to be able to make it work, but that's reality for you.
Yes, I am a security pessimist.
If somebody is doing a distributed chat/social system, I would use ssh if I were them.
By ssh I don't mean execution commands but rather encryption/authentication framework.