41–50 of 89 posts
http://www.cs.cmu.edu/~perspectives/
(hat-tip Lauren Weinstein)
SSL certificates for HTTPS are a big fat scam. Why do I need to pay money to get a certificate, just to provide encryption. Encryption should be separate from identity verification. Of course identity verification should be properly vetted and you should have to pay a fee, and have documents checked etc. If however, you just want to provide security for your users by encrypting http, you should not have to jump throu…
Commercial certificates are not a scam. You're paying for a company (the CA) to certify (via the SSL cert signature) that an identity belongs to someone that has provided proof that they're who they say they are. You can absolutely do what you're requesting by creating your own CA and signing certs for your sites and distributing your CA cert to your users somehow. If you can figure out how to reliably provide this s…
The business model behind certificates may very well be a huge scam. Unfortunately, the technical model behind having a small number of trusted certificates shipped with your browser is not. Until that link breaks, you don't get security without paying Verisign.
Earlier quoted context omitted.
Commercial certificates are not a scam. You're paying for a company (the CA) to certify (via the SSL cert signature) that an identity belongs to someone that has provided proof that they're who they say they are. You can absolutely do what you're requesting by creating your own CA and signing certs for your sites and distributing your CA cert to your users somehow. If you can figure out how to reliably provide this s…
You are absolutely paying a premium based on the market persuasion tactics Verisign and Thawte have employed against the world. It's true that there's no good reason to trust Verisign more than Mozilla, Microsoft, and OpenSSL --- if Mozilla fucks up, you're just as screwed as if Verisign does. The business model behind certificates may very well be a huge scam. Unfortunately, the technical model behind having a small…
The reason you 'trust' Verisign/Thawte/Comodo/Geotrust/GoDaddy is because their roots are in the OSs & browsers. You can't get in those root stores without a hell of a lot of hoop-jumping. I know this. The money you pay for a cert does go to covering the costs of the background checks you have to pass through before you get the certificate.
Trust has to start somewhere - why not with large companies who have undergone rigorous procedures that also have been vetted by the companies you're implicitly trusting by installing their software?
Earlier quoted context omitted.
But what good is encrypted communication if you cant be sure who you are communication with?
Mainly it means that your employer/ISP/someone else using same lan/wifi etc can't sniff your packets. Encryption is useful, and separate to identity verification.
Earlier quoted context omitted.
But what good is encrypted communication if you cant be sure who you are communication with?
What good is verified communication when you can buy an SSL cert with pretty much any fake information you want.
Unbelievable. I've been poking about here for like 6 months now. You are all very smart people. Why is this so hard to understand? If you do not have a valid certificate signed by a CA, SSL is not providing any security . Yes, the warning you get when you visit a site with an invalid cert is much scarier than what you see if you visit an unencrypted site. But it's the sites that use encryption that users care about,…
Good point. You won't find it - performing proper background checks cost more than that.
That's not to say you can't get cheap certificates - they're the domain-only validated ones where you only have to prove ownership of the domain. These are bad because they appear the same as properly-validated certs when they shouldn't. Kaminsky's recent work shows the DNS system can't always be trusted, and so certificates validated on that weak system cannot be trusted either.
However, until GoDaddy and Geotrust stop having lots to lose from DV certs being marked-down by browsers, I doubt they'll let MS, Opera, Mozilla and the rest do such a thing.
Earlier quoted context omitted.
You are absolutely paying a premium based on the market persuasion tactics Verisign and Thawte have employed against the world. It's true that there's no good reason to trust Verisign more than Mozilla, Microsoft, and OpenSSL --- if Mozilla fucks up, you're just as screwed as if Verisign does. The business model behind certificates may very well be a huge scam. Unfortunately, the technical model behind having a small…
It's amazing how many people still think Verisign are the only CA out there. There are a lot now, and if you hunt about, you needn't pay more than $10-$20 for a cert that's trusted in most browsers (granted, they are domain-only validated, but that's a whole different issue that needs to be fixed, I won't bring it up here...) The reason you 'trust' Verisign/Thawte/Comodo/Geotrust/GoDaddy is because their roots are in…
What you and I are really saying is that a company like Thawte has staked their business on those pubkeys, so that we at least know that if they screw up, they stand a good chance of losing the company.
Earlier quoted context omitted.
In this case I disagree. The web is not all corporate, and there is a confusion between encryption and authentication. A certificate, signed or no, is a means to establish a secure connection between Alice & Bob. This ensures no one is snooping or modifying the data passing between them. this is a good thing that should be encouraged in an age when your ISP injects ads and the government keeps tabs on what sites you…
A self-signed certificate does not establish a secure connection between Alice and Bob, because Alice can't verify the certificate. Bob can send his certificate, Mallory can trivially intercept it and replace it with her own, and nobody will be the wiser. Let's not encourage people to adopt security mechanisms that provide no real security. Let's make the security mechanisms we have today, which are strong enough to…
Unless you have a means of verifying the public key fingerprint I you are SOL. Wish I had more modpoints for you.
Earlier quoted context omitted.
That's not the bug though. The bug is that the error message a user sees when visiting a self-signed site using HTTPS is much more scary than simply visiting that site on an unencrypted connection, even though by all reasonable standards this is a safer, more private, and more secure action. If we're not going to warn folks about unencrypted links where every proxy in the way is a man-in-the-middle attack waiting to…
The warning says, "Here is a site that claims to be secure. Maybe you thought it was secure, maybe you didn't. Either way, the site is not secure. DO NOT ENTER YOUR PASSWORDS AND CREDIT CARD NUMBERS HERE." The warning is vibrant because the condition it reports on can be created by an attacker on any SSL connection. That stupid warning might be among the top five security mechanisms on the Internet.
You're assuming all kinds of facts not in evidence. My point was simply that the FireFox tradition (now enhanced) of warning about secure transfers to unverified sites was dumb: it creates a clear incentive for sites not to use HTTPS, so as not to scare their users.
Earlier quoted context omitted.
What good is verified communication when you can buy an SSL cert with pretty much any fake information you want.
I'd like to know where I can buy a cert this way. Pretty please.