優質股發崛人

Despite what I wrote yesterday and my general viewson authenticating SSL , I thinkthat in real life SSL still needs certificate authorities, or at leastsome sort of trust roots. The problem is that normal people are simplynot interested in assessing trust issues and probably are not capable ofdoing so. In fact I'm not sure that I'm capable of doing it.

(As I wrote once before, in practice I make no attempt to actuallyverify the SSH host keys that I get prompted to approve,

One alternative to monolithic certificate authorities is a web oftrust approach to trustissues. Here's my view of the flaws this model as an alternative toCAs, when used in practice.

First, you haven't actually removed the need to pick trust roots; everyuser has to start their web somewhere, and usually they are going tostart from some well-known root or roots. What you have really doneis made trust roots less subject to detailed scrutiny and criticism,and probably made it less obvious