News for hackers. Stuff that matters.

A comment on Launching in 2015: A Certificate Authority to Encrypt the Entire Web. Parent comment

Re:Launching in 2015: A Certificate Authority to Encrypt the... by xnull2guest on Tuesday November 18, 2014 @07:47PM (#8627488)
Do you think that with public key pinning self-signed certs begin to make sense? Also, do you feel that CAs and the PKI system do provide appropriate authentication (this being a cost-benefit rather than a 100%-correctness analysis)?
[ Parent | on HN ]
Re:Launching in 2015: A Certificate Authority to Encrypt the... by tptacek on Tuesday November 18, 2014 @08:33PM (#8627669)
Yes! Key continuity is a legitimate identity scheme; the only trick is to implement it scalably, so it actually happens, rather than being a fig leaf (an unworkable variant of key continuity already exists in browsers today).

I think the CA system by itself is inadequate, but unlike unauthenticated TLS, actually does provide some security.

[ Parent | on HN ]