On Wed, 13 Aug 2014 12:19:40 -0300 Giancarlo Razzolini wrote: > Today there is never a need for self-signed certs. You can get them for > free, there's no excuse.
Tell that to gnupg.org, as I say political... but useful going forward but there are only a few keyservers. Also if you have a secure method to share the fingerprint then self-signed are more secure. Personally I would like someone, perhaps a major browser to create a service where we can login and submit our fingerprint and get a password which they match to a password installed at the root of your website in a file like .sslcheck over ssl and so matching the password and fingerprint. If a rogue has write ability you can't trust the ssl anyway and this keeps it to the basic elements rather than introducing other potential insecurities like DNSSEC would. I am assuming an attacker would find it very hard to create a key to match a fingerprint but could be wrong? I also find myself debating with using a CA signed cert with STARTTLS as it can too easily offer a false sense of security due to downgrade attacks.
