Hacker News Reader

Comment by y0ghur7_xxx | Hacker News Reader

The only problem I see with https everywhere is the current CA system. I don't trust CAs, and I don't want to pay them. If we can get rid of them somehow there is nothing in the way of https everywhere anymore. I really like the http://convergence.io/ approach, but anything else that gets rid of a central authority I have to trust will do for me.

View on HN

I don't trust CAs either but I use self-signed certificates when I want to collaborate securely online with people I know offline --- just give them a hardcopy of the certificate for them to verify and then add to their browser. It's unfortunate that newer browsers are making it harder to do this; I can see the justifications for this being in the name of "security", but can't help thinking that it's another way to keep the CAs happy in their monopoly over trust.

I'm wondering how well this scales. If you have thousands of upon thousands of people/companies that you trust, how do you ensure that they all remain trusted? What happens if you need to go through all of the certificates to ensure they can still be trusted?

Is convergence still running? I last tried it a couple years ago and the number of authorities dropped to three.

Some say it's not dead¹. But it doesn't seem to have any traction, which is a shame.

Perspectives is a similar project and seems more alive with a release in February: http://perspectives-project.org/2014/02/15/perspectives-4-4-...

¹https://twitter.com/ivanristic/status/400624593515192320

Reply on news.ycombinator.com