Am 02.07.2015 um 16:16 schrieb Reindl Harald:
Am 02.07.2015 um 16:04 schrieb drago01:
> On Thu, Jul 2, 2015 at 2:33 AM, Reindl Harald <h.reindl(a)thelounge.net>
> wrote:
>>
>> Am 02.07.2015 um 02:30 schrieb Michael Catanzaro:
>>>
>>> On Wed, 2015-07-01 at 19:59 -0400, Paul Wouters wrote:
>>>>
>>>> Principles are good and well. But how many times did you actually USE
>>>> that option you so reluctantly implemented? :)
>>>
>>>
>>> Actually, I honestly don't remember ever using it except testing it
>>> during development. I just don't visit broken sites. They are few and
>>> far between nowadays
>>
>> that's nonsense
>>
>> a self signed certificate is exactly as secure as a CA certificate
>> you pay
>> for after there are hundrets and thousands by default trusted CA's in
>> the
>> browsers with the only difference you have to accept it once
>
> No its not. Because everyone can issue them you can't really know
> whether it is from who it claims to be from ... even in case you can
> its in case an attacker gains access of it the issuer can't really
> revoke it anymore.
> Browsers do show those warnings for self signed certs for a reason and
> that reason is *not* to sell certificates
*lol* and with a CA certificate you can?
given that there are thousands of CA's and you need *only one* with a
broken verfication process to get a certificate for whatever you want
you can't and if you would read IT news you would know that
the CA system is broken by design
and for "can't really revoke it anymore": please inform yourself and you
know that you in reality can't revoke a cert because all the mechs are
broken, not mandatory in the clients and if they would be mandatory the
OCSP servers would be target number 1 for DOS attacks