News for hackers. Stuff that matters.
Re:Launching in 2015: A Certificate Authority to Encrypt the... by balabaster on Wednesday November 19, 2014 @11:06AM (#8630749)
The problem here is that getting a vetted cert - or worse, compromising the authority that vets those certs is relatively trivial for a nation state, or even someone that's morally compromised enough to say, kidnap the CA Director's family. The fact is, trust is easily compromised and the current infrastructure needs to be hardened against that.

Even if the browser only had a single authority you do trust... how easy would it be for someone to force them to do something to compromise your trust? For instance with an NSL bound with a gag order?

Re:Launching in 2015: A Certificate Authority to Encrypt the... by tripzilch on Thursday November 20, 2014 @05:21AM (#8635084)
> Even if the browser only had a single authority you do trust... how easy would it be for someone to force them to do something to compromise your trust? For instance with an NSL bound with a gag order?

By having several authorities you do trust? Preferably in different jurisdictions and parts of the world. But only those who you do trust.