[139029] in North American Network Operators' Group
RE: The state-level attack on the SSL CA security model
daemon@ATHENA.MIT.EDU (Akyol, Bora A)
Fri Mar 25 11:36:20 2011
From: "Akyol, Bora A" <bora@pnl.gov>
To: "Dobbins, Roland" <rdobbins@arbor.net>, nanog group <nanog@nanog.org>
Date: Fri, 25 Mar 2011 08:36:12 -0700
In-Reply-To: <EA84622E-7E28-47D9-A521-C4B3A2CD48FE@arbor.net>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
What other choice does the public have? By locking them into the current tr=
ust model (for good or bad), the community has created this mess.
Is it far fetched to supplement the existing system with a reputation based=
model such as PGP? I apologize if this was discussed before.
-----Original Message-----
From: Dobbins, Roland [mailto:rdobbins@arbor.net]=20
Sent: Thursday, March 24, 2011 3:28 AM
To: nanog group
Subject: Re: The state-level attack on the SSL CA security model
...
Unfortunately, the general public neither know, understand, or care about s=
uch things. They happily click 'I Understand the Risks' or whatever the bu=
tton says in their browsers of choice to accept self-signed certificates al=
l the time.
...
