Hacker News new | past | comments | ask | show | jobs | submit login

[flagged]



It would be rational and moral (within Google's own worldview) to sell EV, drive all the other EV sellers out of business, and then stop. It's a lot harder to get into the EV business than into the homeopathy business, so it's not quite comparable to your doctor trying to drive the homeopaths out of business.


Tying a legal identity to a cert is not snake oil. It's a fundamental part of every crypto system, including PKI prior to GeoTrust making DV in 2003.


It's not a fundamental part of most cryptocurrencies: it suffices to have a private key be able to send and receive money from its own account, without knowing what legal entity controls that account.

It's not a fundamental part of Signal; the cryptosystem only identifies phone numbers, not legal identities. Similarly, it's not a fundamental part of Keybase, which only identifies social media accounts.

It's not a fundamental part of PGP; it's traditional to verify legal identity (and some users have a need for that), but it's not at all required and you can have a pseudonymous key in the strong set pretty easily.

It's not a fundamental part of military encryption, where the legal entity is just "this country's military," but internal distinctions matter.

It's not a fundamental part of Tor, which goes to lengths to lose track of the legal identity of its users.

There are advantages to identifying the legal entity that controls a website, sure, but 99% of the advantage of SSL is identifying a site name so that cookies are only sent to the same site, JavaScript is only accepted from the same site, a bookmark opens only the same site, a link from elsewhere on the web opens only the same site, etc. And in most cases, "legal entity" is just a proxy for "entity I expect". When I visit gmail.com, I'm looking for the entity I previously visited at gmail.com; knowing that gmail.com is now Alphabet instead of Google doesn't really help me, but knowing that it's the same site does. When I register an account in person at First Bank of Springfield and go home to log in, I care less that the website I find is controlled by one of the many First Banks of the many Springfields than that it is the same entity I just signed up for an account with - and I can guarantee that by typing in the https URL they gave me on the welcome brochure.


In cryptocurrencies the desire is often to not tie a legal entity to a wallet, hence digital cash. Likewise Tor, again anonymity may be the entire the purpose. However other mechanisms exist that do exactly this when desired: Tor only uses EV SSL to make sure you're communicating with the legal entity you think you are. At CertSimple we have customers including Privacy International and Buzzfeed that use our Tor EV product for exactly this.

Linking PGP keys to identities is done at most well known universities, as you noted.

Keybase links pubkeys to social media accounts, but that's also the point: a single network endpoint is not a sufficient indicator of identity.

Debian key parties link passports and drivers licenses to pubkeys.

Windows binaries are signed with EV certs.

> I can guarantee that by typing in the https URL they (the bank) gave me on the welcome brochure.

Users will never type in most URLs, let alone every URL.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: