5 ms·

Who cares? What does a certificate tell me other than someone paid for a certificate. And what do certificate buyers gain? The ability for their site to be rev

Who cares? What does a certificate tell me other than someone paid for a certificate. And what do certificate buyers gain? The ability for their site to be revoked or expired and thus no longer work. I’d like to corrected.

brazzy 1y ago
Are you seriously not aware of Let's Encrypt? https://letsencrypt.org/ https://letsencrypt.org/ Nobody has really had to pay for certificates for quite a number of years. What certificates get you, as both a website owner and user, is security against man-in-the-middle attacks, which would otherwise be quite trivial, and which would completely defeat the purpose of using encryption.
- transfire 1y ago
  As long as Let’s Encrypt is still around. I find it hard to believe there is no way to secure without requiring an authority in the middle.
squiggleblaz 1y ago
A certificate authority is an organisation that pays good money to make sure that their internet connection is not being subjected to MITMs. They put vastly more resources into that than you can. A certificate is evidence that the server you're connected to has a secret that was also possessed by the server that the certificate authority connected to. This means that whether or not you're subject to MITMs, at least you don't seem to be getting MITMed right now. The importance of certificates is quite clear if you were around on the web in the last days before universal HTTPS became a thing. You would connect to the internet, and you would somehow notice that the ISP you're connected to had modified the website you're accessing.
- Ajedi32 1y ago
  > pays good money to make sure that their internet connection is not being subjected to MITMs Is that actually true? I mean, obviously CAs aren't validating DNS challenges over coffee shop Wi-Fi so it's probably less likely to be MITMd than your laptop, but I don't think the BRs require any special precautions to assure that the CA's ISP isn't being MITMd, do they?

brazzy 1y ago

Are you seriously not aware of Let's Encrypt? https://letsencrypt.org/ https://letsencrypt.org/ Nobody has really had to pay for certificates for quite a number of years. What certificates get you, as both a website owner and user, is security against man-in-the-middle attacks, which would otherwise be quite trivial, and which would completely defeat the purpose of using encryption.

transfire 1y ago
As long as Let’s Encrypt is still around. I find it hard to believe there is no way to secure without requiring an authority in the middle.

squiggleblaz 1y ago

A certificate authority is an organisation that pays good money to make sure that their internet connection is not being subjected to MITMs. They put vastly more resources into that than you can. A certificate is evidence that the server you're connected to has a secret that was also possessed by the server that the certificate authority connected to. This means that whether or not you're subject to MITMs, at least you don't seem to be getting MITMed right now. The importance of certificates is quite clear if you were around on the web in the last days before universal HTTPS became a thing. You would connect to the internet, and you would somehow notice that the ISP you're connected to had modified the website you're accessing.

Ajedi32 1y ago
> pays good money to make sure that their internet connection is not being subjected to MITMs Is that actually true? I mean, obviously CAs aren't validating DNS challenges over coffee shop Wi-Fi so it's probably less likely to be MITMd than your laptop, but I don't think the BRs require any special precautions to assure that the CA's ISP isn't being MITMd, do they?