Hacker News Reader

Comment by coldpie | Hacker News Reader

> provide the public keys to my clients

How does this part happen? How does the client know that the entity providing them with that public key is who they claim to be?

View on HN

You visit the bank in person and the bank gives you the keys in a flash drive, QR code, printed paper, ... Then you go home and install the keys

So, you're right that this does work in theory, but it obviously doesn't scale, right? We can't have every person physically go to every storefront they want to purchase something from and then drive home with a USB stick. What if I in Minnesota want to buy something from Florida or France?

The role CAs play is to be a trusted identity verifier so we don't have to have millions of people driving around to do key exchanges in person.

That makes sense. The downside is that now if said CA has some interests in whether to re-issue a certificate or not, we have a problem. Imagine that Cloudfare decides you are a bot and doesn't allow you to visit pages. You are going to have a problem because a lot of websites use it

I think the idea of a CA is good but it should be distributed somehow

Yeah, of course. Every solution has pros and cons, you gotta settle on the best one for the world you live in.

CAs are quite distributed already. You probably have a couple dozen or even a hundred different root CAs installed right now, and you can install whatever ones you like if necessary.

People don't really know how to install SSL certs, it's intentionally not easy especially on phones, and it's not clear that what they're installing only affects the bank. But yeah, the industry could make this semi-easy if there were a real need.

they can fetch the key or its hash from DNS. it's not like the current system is that much more involved. current system is basically a third party signed cache of such ownership claims validated based on ability of someone to modify DNS records.

All caches are just functionally useless layers..., so that's that.

How do I know that the DNS record is owned by the entity they are claiming to be? CAs have nothing to do with caching.

You don't know that even with DNS validated certificates. There's no separate "entity" claim other than "anybody with DNS record modification rights for a given domain".

You can give out the same claim over DNS directly without any extra third party involvement in the form of CA.

Huh, wow. I kind of thought the whole point of CAs was to do identity verification. It they have dropped that entirely, what is the point?

DNS can be trivially MITM'd as well, it's certainly not a secure mechanism for distributing keys.

You just taken down the whole business of dns validated CA issued certificates. Go claim your bounty. :)

How do I know what certificates come with my browser?

You can go look at them. In Firefox, head to "about:certificate" and click the Authorities tab.

You could also install a hypothetical bank certificate that way

Reply on news.ycombinator.com