CA Comodo used broken OCR and issued certificates to the wrong people

Re:CA Comodo used broken OCR and issued certificates to the ... by LukeShu on Friday October 21, 2016 @12:28PM (#12761788)

I recall a website with a self-signed cert, but they had a non-https page that had a their TLS cert fingerprint signed with their GPG key; which effectively moved the trust from the centralized CA system to the PGP web of trust.

I think it would be cool to have a standard URL (/.well-known/certificate or something) that explains why you should trust their self-signed certificate, and have the browser show that as part of the view when you encounter a self-signed cert.

[ Parent | on HN ]

Re:CA Comodo used broken OCR and issued certificates to the ... by 45h34jh53k4j on Friday October 21, 2016 @12:37PM (#12761889)

Then you have leaked material over http or some other cleartext protocol. If you try to add encryption to that you just have turtles or move the key exchange somewhere else.

The current PKI system allows you to make an unsolicited encrypted connections to an internet origin over an untrusted connection with strong server authentication.

Self signed can not provide this. We do not want the web to be like SSH.

[ Parent | on HN ]

Re:CA Comodo used broken OCR and issued certificates to the ... by geofft on Friday October 21, 2016 @12:43PM (#12761962)

How many people do you think actually verified the PGP key? https://xkcd.com/1181/

Also, PGP is a very different security model - in order to effectively use PGP, you need to go disclose your government identity to a handful of other people who are already in the strong set. That's not a great fit for the web.

[ Parent | on HN ]