On Sat, 2014-03-22 at 13:42 +0000, Ivan Shmakov wrote: > First of all, accepting some > “random” certificates may give the users some false sense of > security.
This is true, and also a reason why I'm really convinced of the argument encrypt/sign,... even if it's not trusted... Especially the argument that the only problem one has are MitM attacks sounds kinda stupid.... since everyone that can intercept your traffic (which an attacker would need to be able anyway - even if all was clear-text)... can also easily do MitM attacks... But what you talk about: "false sense of security"... that goes much farther... The whole current X.509 based strict-hierarchical trust model with gazillions of CAs gives a false sense of security. Especially when it's controlled by companies like MS, Apple, Mozilla for whom only money counts and who are themselves under the control (just as the CAs as well) of governments. And especially when you have CAs in the list, for which you know for sure, that they will happily assist their governments in forgery ... CNNIC, Turktrust,... just to name the most obvious... Cheers, Chris.
smime.p7s
Description: S/MIME cryptographic signature
