Hacker News Reader

Comment by superkuh | Hacker News Reader

A protocol that only works on the whim of a third party corporate person is not optimal for human people. Baking in a requirement of CA based TLS is not great.

>TLS: Certificate, the certificate for this host, containing the hostname, a public key, and a signature from a third party asserting that the owner of the certificate's hostname holds the private key for this certificate

View on HN

You can generate your own root cert and self-sign. No need for third-parties.

Do mainline browsers (chrome/firefox/safari) accept this? Do they do it without scaremongering warning the prevent access like with normal TLS and self-signing?

You import your "CA cert" into the browser or the underlying operating system, and then the browser accepts the certs signed by it.

I found minica very useful to do something like this (no affiliation): https://github.com/jsha/minica

And your solution is?

DNSCurve's self-authenticating domains: https://en.m.wikipedia.org/wiki/DNSCurve

It's like "onion URLs" without the rest of Tor. Or like b32.i2p domains without the rest of I2P.

I hope to god this catches on. At this rate it won't, because a FAANG company isn't supporting it. But I still hope somehow it will catch on. DJB's work is fantastic and this is no exception.

I don't believe it will catch on. Consumers don't care about security. Engineers do, but not at expense of usability.

It's very simple. Allow not using encryption. Plain text + encrypted make a great team. Either by themselves is not great.

Reply on news.ycombinator.com