undefined | Better HN

0 pointsAmericanChopper5y ago0 comments

It’s the PKI paradigm that creates most of the insanity. Authentication is still an unsolved issue with PKI, there’s many ways that you can perform authentication, but all of the different approaches lead to one form of insanity or another. The CA system has its share of insanity, but it is the most successful PKI implementation in history, and by a long way.

0 comments

pwdisswordfish25y ago

PKI authentication is only insane when delegated to a third party. There is a built-in assumption within the CA system that no two parties can ever trust each other and intermediaries are always needed. A world of strangers who never learn anything about or get to know each other. It is either impractical or impossible for the first party to trust the second, using this system, without third party intervention. What reason is there that a website owner should never send a CSR to an end user who creates her own CA cert? Why are third parties the only ones permitted by websites to sign their certificates? Welcome to the world wide web of middlemen.

AmericanChopperOP5y ago

Well you can’t perform authentication over an insecure channel, and you can’t have a secure channel without authentication. Either you trust an authority, or you authenticate manually yourself. There’s a reason TLS uses the CA system, and not PGP.

pwdisswordfish25y ago

You can authenticate outside of the insecure channel. There is a real world outside of the internet.

It is this "manual authentication" that the CA system does not account for. It is not an option. Why is it that, in practice, the only certificates an end user's "CA" can sign are the end user's server certificates?

1 more reply

j / k navigate · click thread line to collapse

0 pointsAmericanChopper5y ago0 comments

0 comments

pwdisswordfish25y ago

AmericanChopperOP5y ago

pwdisswordfish25y ago

You can authenticate outside of the insecure channel. There is a real world outside of the internet.

1 more reply

j / k navigate · click thread line to collapse