undefined | Better HN

0 pointsocdtrekkie2mo ago0 comments

Well, be prepared for certificates that change every 7 to 47 days, as the Internet formally moves to security being built entirely on sand.

0 comments

webstrand2mo ago

I wonder if this is a potential "off switch" for the internet. Just hit the root ca so they can't hand out the renewed certificates, you only have to push them over for a week or so.

gus_massa2mo ago

People will learn to press all the buttons with scarry messages to ignore the wrong certificates. It may be a problem for credit cards and online shopping.

ocdtrekkieOP2mo ago

HSTS was specifically designed to block you from having any ignore buttons. (And Firefox refuses to implement a way to bypass it.)

But this is also why the current PKI mindset is insane. The warnings are never truly about a security problem, and users have correctly learned the warnings are useless. The CA/B is accomplishing absolutely nothing for security and absolutely everything for centralized control and platform instability.

blibble2mo ago

> The CA/B is accomplishing absolutely nothing for security and absolutely everything for centralized control and platform instability.

is it their fault?

with the structure of the browser market today: you do what Google or Apple tell you to, or you're finished as a CA

the "forum" seems to be more of a puppet government

1 more reply

account422mo ago

Any user agent worthy of the name will ignore that user-hostile part of the spec.

j / k navigate · click thread line to collapse