HTTPS is more secure, so why isn't the Web using it?

Re:HTTPS is more secure, so why isn't the Web using it? by fierarul on Monday March 21, 2011 @05:36AM (#2349017)

Well, the yearly charge isn't such an issue, but I cringe knowing I could pay a small server for an year of uptime with the money I pay for an SSL cert, which is essentially an official stamp of a member of the CA oligarchy.

I mostly do contract work so I don't need SSL on my front-facing sites. We do use sites that have SSL to send deliverables and such, but I just pay for their service, not for the cert itself. Internally we've also used self-signed certs, our own CA or just SSH port forwarding.

As an industry we should move towards encription but away from the current CA model. Somehow everybody portrays it as if it's the same thing.

[ Parent | on HN ]

Re:HTTPS is more secure, so why isn't the Web using it? by T-hawk on Monday March 21, 2011 @01:59PM (#2350823)

Encryption in itself does little good without a certification authority model. Without a mathematically robust CA chain, you never know if you're sending your encrypted traffic to your intended target or to a man-in-the-middle attacker pretending to be your target. Encryption protects against a passive sniffer but not a party capable of intercepting messages.

[ Parent | on HN ]