Hacker News Reader

Comment by gonzalohm | Hacker News Reader

You visit the bank in person and the bank gives you the keys in a flash drive, QR code, printed paper, ... Then you go home and install the keys

View on HN

So, you're right that this does work in theory, but it obviously doesn't scale, right? We can't have every person physically go to every storefront they want to purchase something from and then drive home with a USB stick. What if I in Minnesota want to buy something from Florida or France?

The role CAs play is to be a trusted identity verifier so we don't have to have millions of people driving around to do key exchanges in person.

That makes sense. The downside is that now if said CA has some interests in whether to re-issue a certificate or not, we have a problem. Imagine that Cloudfare decides you are a bot and doesn't allow you to visit pages. You are going to have a problem because a lot of websites use it

I think the idea of a CA is good but it should be distributed somehow

Yeah, of course. Every solution has pros and cons, you gotta settle on the best one for the world you live in.

CAs are quite distributed already. You probably have a couple dozen or even a hundred different root CAs installed right now, and you can install whatever ones you like if necessary.

People don't really know how to install SSL certs, it's intentionally not easy especially on phones, and it's not clear that what they're installing only affects the bank. But yeah, the industry could make this semi-easy if there were a real need.

Reply on news.ycombinator.com