Hacker News new | past | comments | ask | show | jobs | submit login

Having a trusted third party is a pretty big deal in cryptography. Without it, many of the core assumptions of public-key cryptography are invalid. It's a huge part of making sure the other end is authentic. I'd place a lot more trust in Bank A's public key if it was signed by verisign, rather than an unverified third party. Having verisign's public key in my browser elimininates a large class of man-in-the-middle attacks.

If paying $20/year is too inconvenient for you to transfer your data securely, then perhaps the data isn't sensitive enough, and you shouldn't bother.




It's not even that complicated.

The problem with not having a valid certificate is this: if both sides can't tie every packet in the SSL handshake back to Verisign or Thawte's pubkey, attackers can inject their own handshake passwords and set the session key.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: