Trusting unknown parties for security? Welcome to the web


9 Responses to “Trusting unknown parties for security? Welcome to the web”

  1. jowlsey says:

    @mr_josh- enable the numeric keypad, hold down the alt key, then type 059 using numeric keypad.

  2. Anonymous says:

    A big part of the problem seems to be the willingness of browser- and OS-makers to turn a blind eye to sleazy CAs.

    So, the attitude that results in knowingly shipping shoddy goods in turn enables sleazeballs to flourish?

    Just like in every other field of endeavor?

    “All that is necessary for evil to triumph is for good men to do nothing”

  3. Nadreck says:

    On the interWebs you’re in a dark room, shouting at people whose faces you can’t see. As you enter the room you get a binder of unforgeable signet ring impressions. If someone gives you a business card with one of these seals on it you can trust that they are who they say they are: if you trust the binder publisher that is.

    Sometimes the signet rings get stolen. Over at one window of the room there’s a box, that gets restocked once a week, where you can pick up a list of stolen signet rings. Or you can shout out to some of the people in the room and ask them if they remember stamping so-and-so’s business card. After all, maybe they don’t know that their ring was stolen for a while. You don’t ask for a business card from the people that answer you.

    Then there’s the problem of ventriloquists…

  4. Anonymous says:

    What a ridiculous keyboard; no more semi-colons or colons. And most importantly, no more ellipses!

    “He who sacrifices his grammar for security deserves neither”, I believe the quote goes.

  5. creesto says:

    I’ve been surfin since about the time bOING bOING went webzine, and I’ve never fallen for an online ruse. I know, I know:

    Famous. Last. Words.

    After all this time, my philosophy is simple:

    Don’t. Trust. Whitey.

  6. EH says:

    This article is naive, it’s turtles all the way down. Verisign is the original hijacker, an “authority” by fiat.

    • Glenn Fleishman says:

      That’s an awesome retort. I would only respond, as the doubly naive writer, that VeriSign has never so far been accused of using its commercial role for corporate or government espionage, while there is suspicion that other CAs may have been suborned or hijacked for this goal. We simply don’t know.

      Google’s certificate almanac is a fascinating project, as it may expose wrongdoing that we were previously completely unaware of. (Or not.)

  7. mr_josh says:

    I’ll just go ahead and ask: how do you type a semi-colon on that thing?

Leave a Reply