Re:Marking HTTP as Non-Secure
by hueving on Saturday December 13, 2014 @02:44AM
(#8744547)
Uh, of course it does. If it didn't guarantee the server you were communicating with had the private key for the certificate it is presenting, it would be worthless.
[ Parent
| on HN ]
Well, of course the NSA would have the private key for their own certificate. Having the private key for a previously unknown certificate doesn't, in and of itself, prove that you are not the NSA.
Yeah, because the NSA and such don't have access to certificate authorities in the first place, right?
Which is why you are supposed to throw out untrustable Certificate Authorities.
In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.
>In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.
Have vendors done it? Because users will surely not bother.
Besides, what makes the other CAs' trustworthy?
They are just some companies, with offices, CEOs, etc. Can have ties to the government, deals, pressure on them, or even just plain planted engineers...