News for hackers. Stuff that matters.

A comment on Launching in 2015: A Certificate Authority to Encrypt the Entire Web. Parent comment

Re:Launching in 2015: A Certificate Authority to Encrypt the... by userbinator on Tuesday November 18, 2014 @04:44PM (#8626548)
The SSH approach is exactly what I was thinking of, where you know the fingerprint of the other side you're connecting to.

I believe verification should be done out-of-band, using some other way (e.g. advertising) to transmit the fingerprint to the users. I've used self-signed certificates to collaborate over HTTPS with people I know in real life, and all I do is give them little pieces of paper with my cert printed on them.

[ Parent | on HN ]
Re:Launching in 2015: A Certificate Authority to Encrypt the... by jcase on Wednesday November 19, 2014 @07:11AM (#8629555)
With SSH you usually own both endpoints (or at least trusting your cloud provider).

The example you give with regards to exchanging a piece of paper is very similar. It's ridiculously hard to do such a thing on large scale without trusting intermediaries.

I'm putting my eggs on certificate pinning.

[ Parent | on HN ]