Hacker News new | past | comments | ask | show | jobs | submit login

If you don't trust the CAs, then getting a certificate from one of them so that https is enabled and crypto works is no worse than no encryption at all, is it?

I understand it might give people a false sense of security, or perhaps they trust the CA system and it's not false in their eyes, but if distrust of CAs is the reason to use plaintext connections instead, I'm not sure that's the best choice.




I think the issue is that your use of the crypto functions is dependent on permission from a CA. Depending on the nature of the application you're serving over HTTPS, a CA could be compelled under DMCA to revoke your certificate, and thus your permission to use the crypto APIs.


I suppose that's a valid point, even if it seems far-fetched that this would be the most effective way of killing someone's software.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: