On 09.01.2009 02:15, Robert Relyea wrote:
Ben Bucksch wrote:
Advocacy:
One of the core assumptions of the x.509 world is ONE SIGNATURE, and
ONE AUTHORITY.
Thing is: There is no one authority :-). God doesn't issue SSL
certificates. Apart from him, I trust only me and my friends.
That's clearly not the case. You have admitted to owning a credit
card. In very real ways you trust a lot more than yourself and your
friends... for a lot more than whether this website is who it says it
is...;).
I wasn't talking about money. There are more important things than money.
I was talking about emails (where the damage can be far higher, even for
private mails), application update, configuration frontends of my own
systems etc..
Obviously I "trust" the software I run, out of necessity. I do not trust
the CA operations. If there was minimal hope that they'd do a decent
job, that has been destroyed over last Christmas.
Ben
_______________________________________________
dev-tech-crypto mailing list
dev-tech-crypto@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-tech-crypto
