Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Not when you are a certificate authority that is already trusted by the browsers.

Modern browsers today accept a large number of "self-signed" certificates. The key is that the signer paid the browser makers money for that privilege. SSL assumes that those companies are all trustworthy, but is any company trustworthy when the government shows up with guns and asks for the master password to your key signer?

If no, then SSL fails.

Let me summarize because you seem to be misunderstanding: a lot of untrustworthy parties are trusted by browsers. This makes SSL somewhat useful against having a coffee shop steal your Facebook password, but almost certainly useless against having a government steal your password.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: