Hacker News Reader

Comment by 0x073 | Hacker News Reader

Next blogpost: Alternative certificate authority

FYI: There is CAcert.org[1][2], which attempted to establish a community run authority (long before let's encrypt was a thing) and IIRC Mozilla was at least discussing including their root cert.

I remember some years back at Chaos Congress in Hamburg, a friend of mine who was very enthusiastic about CAcert physically met with a few CAcert people to show them his passport and get his certificate signed.

[1] http://www.cacert.org/

[2] https://en.wikipedia.org/wiki/CAcert.org

imo if cacert had bee included in any major browser, it would have dumpstered the ca-industry in a week. the verification process with passports and physical meetings meant it had better security and crowdsourcing made it effectively free of charge; billions of revenue just gone.

You'd have needed at least Mozilla and Microsoft to be on-board. The failure mode for a CA is that someone cannot use your site and that's not something you can ignore for serious usage — it took Let's Encrypt years and backing by influential organizations to get established. I like CA Cert, got verified with my passport at Usenix, etc. but still ended up not using it anywhere except some personal servers because life is way too short to walk people through installing a CA, especially with the knowledge that you're training them to be susceptible to attacks.

That post is in the works for months now, I have a huge list of dumb ideas to go through

I'd be very interested if your post contains an OpenPGP-CA review. I'm more familiar with "traditional" ways and that project looked very interesting to me.

What do you want to know? It's quite easy to set up a new CA, and all mainstream browsers have (albeit crappy) user interface for adding them.

The root ca installation is the boring part, installing a local Let’s Encrypt instance is much more fun

Reply on news.ycombinator.com