Hacker News Reader

The very problem here is that I am not ok with middle man becoming the real website. If you are ok with that, you don't have a problem. You can use TOFU. Good for you. But I have a problem with that. So I can't use TOFU.

View on HN

I'm saying that this is not your real problem. Your real problem is that you expect the "real website" to correspond to real world entities. And this can be solved better than the current state.

You mean it can't be solved with Let's Encrypt? Yes, I agree.

What about TLS certificates attested by CAs who validate the real world legal entity? Would you agree that this is a solved problem there?

Yes this solves it partially. The thing is that people assume that the green lock correspond to the domain name. It would be completely solved, if the browser would still show the validated company name, like it used to be, and then people would only validate that and the CA also validating that there are no similar names. The latter would essentially mean that there is a global coordination of CAs and that there only one entity on the whole world could have the same name, i.e. we only have one jurisdiction.

Reply on news.ycombinator.com