You could jettison PKI though. Self-signed certificates would provide as much security after the initial connection. The theory of PKI is that the CAs are providing a source of trust in the identity of the certificate holder, but that is mostly meaningless if domains cannot be meaningfully connected to real businesses and/or people.

How exactly do you think a self-signed certificate addresses this problem? I connect to BANKOFAMERICA.COM. It presents me a self-signed certificate. How do I know if that's BofA's self-signed certificate, or any active attacker's?

How do you know bankofamerica.com is owned by the actual Bank of America? Or that someone didn't use a Cyrillic character in that URL so it looks legitimate and even has a CA-signed cert? Or that one of the more questionable CAs hasn't given someone else a cert for bankofamerica.com.

I am not saying issuing self-signed certs are great, merely that CAs do not meaningfully improve on them if domain validation is all we have, because domain validation doesn't tell you a heck of a lot.

As you said in another response, the CA system has problems. EV, at least, represents something useful when issued by a CA and solves a real problem. And the problems with EV Troy complains about are all fixable.

You keep answering this question with an unrelated question. Like I said: phishing works and is too easy to accomplish. That isn't an answer to the question I just asked you.

You are dismissing the primary issue at hand, which underpins the entire conversation. Phishing is what EV addresses. And if you're not addressing phishing, you're not meaningfully addressing any sort of Internet security whatsoever.

The incoherence of EV as a response to phishing is part of why it's failed. But I'm not talking about EV; I could care less about EV. I'm addressing your (false, increasingly so as thread deepens) claim that HTTPS doesn't require any form of PKI and that users might as well rely on self-signed certificates. Obviously: no.

The self signed cert will need to be rotated from time to time, without being signed by previous cert because e.g. private key was lost or because private key is known to have been compromised. How will your browser, connected to cafe wifi, know that change in self signed cert since last connection is legitimate vs MiTM by wifi AP in cafe?

The CA provides multi perspective check from servers connected to internet backbone, where network hijack is harder than at cafe wifi AP.

The CA system also provides dozens of organizations all over the world to issue certificates for any domain and to hand them out to pretty much anyone.

If Microsoft included a self-signed cert in my Windows install for itself, I would know my communications with Microsoft came from whoever made my Windows operating system. Meanwhile, with PKI, dozens of companies can technically generate certificates for microsoft.com and we're just all hoping none of them do it without getting caught.

You haven't answered the question. There are flaws with the CA system, yes. But replacing it with self-signed certificates creates new problems. How do you address them?

There are mitigations in various stages of progress for this, like certificate transparency, CAA records, and the removal of CAs who violate best practices through either malice or stupidity.

Those changes are being largely driven by Google/Mozilla/etc, via enforcement around what CAs must do in order to be part of the root of trust.

Switching to self-signed certs doesn’t remove any problems. With current PKI, dozens of companies can generate certificates for my website which will be trusted by user browsers. Without PKI, literally anyone can generate a self-signed cert for my website, and there’s no concept of which certs are valid, unless somehow everybody finds a way to share which certs are theirs (and solving that is generally called “PKI”).

EV doesn’t allow self-signed certs to work either, or viably replace DV certs for any threat models, because it’s just as easy to register a similar-sounding company name as to register a similar-looking domain name. Arguably it’s easier, because you can actually register exactly the same name, just in a different jurisdiction.

Your OS or an app talking to their mothership can and do use cert pinning. What about all the millions of websites?

A rogue/compromised CA will be caught by certificate transparency and distrusted.

Also, as 'tptacek noted, you haven't explained how to securely use self signed certs to protect against attacker at the WiFi AP, which is a very accessible kind of attack (compared to compromising a CA, a registrar, a datacenter or internet backbone traffic).