Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hello, OpenPGP CA

sequoia-pgp.org

Post reply on HN
Print view View original

11–12 of 12 posts

Re: Hello, OpenPGP CA

#11

Post by Woung1938 »

viraptor wrote: post #7
lapinot wrote: post #6

This makes so much sense since every identity exists in the context of some authority, some common referential. You're never completely alone as the pgp-classic web of trust implies, instead you're trusting some centrally managed keys like your distros packet signers wich you always blindly accept.. The problem is we rarely sign keys as introducers (and rightfully so) since being a CA is a big responsability. CAs are…

In practice the public CAs didn't quite work out. www.cacert.org tried it, and was interesting, but didn't work out in the end. Especially now its a bit of a joke with the login page on http and the website certificate not being cross-signed, so you have to accept them explicitly.

cacert.org unnecessarily tried to merge real-world authentication of people with certificates to sites.

Re: Hello, OpenPGP CA

#12

Post by pharaohgeek »

georgyo wrote: post #10
georgyo wrote: post #9

Earlier quoted context omitted.

While you're 100% correct, some organizations use S/MIME to send signed and encrypted emails with their TLS x.509 certs signed by their companies TLS CA. But you can also get your X.509 cert signed by a public CA and then anyone on the internet can verify your S/MIME signed email. In practice I've only seen this in government and government contractors, but I'm sure it is done else where. The flaws with the above app…

I'll also add the the federal US government makes extensive use of personal TLS certificates, and they store the private key material on a smartcard embedded inside your ID. Your cert is used from everything from signing and decrypting emails to gaining access to sites to signing attestations that something happened.

Partially true. TLS stands for "Transport Layer Security". TLS certificates are used on servers to encrypt communication. The certificates on the smartcard are used for digital signatures, encryption, and authentication. All of those certificates follow the X.509 certificate standard.
Post reply on HN