| |||||||||||||
Profit!Profit!Posted Mar 28, 2010 8:11 UTC (Sun) by man_ls (subscriber, #15091)In reply to: Cert generation by dlang Parent article: Blaze: The Spy in the Middle The marginal cost of an additional certificate, in terms of keeping backups and revocation lists and securing master keys is close to zero. Storing and sending 2KB has always been cheap. The only item with an appreciable marginal cost is identity validation, and the validation done by "certificate authorities" is a joke, now as always. Why? Because they are businesses; you just have to follow the incentives. Imagine the amount of identity validation done by credit agencies such as Visa, or even by banks: they are very superficial. These guys are actually giving you credit, and they will have to pay if you don't. Even so, the amount of validation is (at least here in Europe) hardly worth 10, according to my own estimations. Now what incentives do CAs have to make thorough checks? They are not giving you credit, and they have zero liability if you are not who you claim to be. Therefore it makes good business sense to skim over any ID presented and not think twice about it.
(Log in to post comments)
|
|||||||||||||