|
|
|
|
|
|
by throw5427
3168 days ago
|
|
|
Trust keys on first use. Like SSH. https://www.tedunangst.com/flak/post/moving-to-https "So how does one verify that the downloaded cert is the original? The same way the CAs do. Perform a DNS lookup, make a web request, trust the result. The addition of HPKP would indicate that people find the CA model untrustworthy, solving the problem with trust on first use key continuity. Why not cut out the middle man? Protesting the CAs is admittedly pretty futile, but if I can’t do it, who can?" |
|
|