Hacker News Reader

Comment by robryan | Hacker News Reader

It's a tradeoff I guess, at the low end people don't want to provide documents, wait and pay a decent amount to get their identity verified.

Maybe it would be best to separate them, you can self sign or equivalent for encryption and the identity system can be separate.

View on HN

There is little point in encrypting traffic if you can't differentiate between a man in the middle and your desired endpoint.

EX: Conceder I open encrypted connection to amazone.com which pretends to be amazon.com they open an encrypted connection to amazon.com. Amazone can now pretend to be Amazon and read all my encrypted traffic.

Consider someone sniffing wifi. I'm worried about eavesdropping much more often than man in the middle, and nontrusted SSL could provide that if browsers would stop freaking out and just go without a padlock.

Users can differentiate between "amazon.com" and "amazone.com" via the browser's location bar. There's nothing stopping the owner of "amazone.com" from getting an SSL cert signed by a "trusted authority", so SSL does not help in this respect. My opinion is that conflating identity with encryption is a fundamental problem.

Some users can differentiate... assuming they notice.

The issue is in the real world building a system to handle both typos and hostel networks requires some form of authentication.

You need some amount of identity checking, to tell you that the https://uncesnsored.citadel.org/ you're talking to today is the same one you were talking to yesterday and last week. SSH handles this by remembering the key used on the first connection; Perspectives goes one better and checks from multiple parts of the network.

Tying these online identities to physical-world identities is what can be separate.

Reply on news.ycombinator.com