On Sun, Dec 30, 2012 at 3:30 PM, Keith Medcalf <kmedc...@dessus.com> wrote: > Your assertion that using "bought" certificates provides any security benefit > whatsoever assumes facts not in evidence. > > Given recent failures in this space I would posit that the requirement to use > certificates purchased from entities "under the thumb" of government control, > clearly motivated only by profit, and with highly questionable moral and > ethical standards represents a huge increase in risk of passive attack and > confidentiality failure where such rosk did not previously exist. >
backing up some, I think the problem trying to be solved by requiring 'legitimate' certificates is stopping the obvious problems of mitm attacks, ala mallory-proxy. in the longer term, if the client can know that the server was supposed to present a cert with fingerprint XFOOBYFOOB and it can see that fingerprint for the cert presented in the session we all win, right?
