It's Time to Fix HTTPS
I think it's important to know that, whether you agree with this deck that key continuity ("tofu/pop") is a better approach than PKI or not, what we're talking about here is a misconfiguration of SSL caused by a political quandary, not a fundamental problem with SSL/HTTPS.<p>The fact is, if your browser trust roots contain only trustworthy CA's, and you look to make sure you're using a secure site when you expect to, SSL isn't broken. Those sound like two big "ifs", and they may be, but consider: they are both user interface issues:<p>* There is no collaborative interface for community-rating CA trustworthiness, or even a reasonable interface for pruning CA's out of your browser --- let alone "do I trust certificates delegated from this CA, or just the CA itself". We are still using an interface for this functionality designed in the mid-'90s.<p>* The "first introduction" problem that key continuity suffers from is, in the SSL case, caused by the fact that the SSL cues in the browser are subtle. But why should that be the case? Is there really no interface anyone can come up with that appropriately signals "this page should be and is secured by SSL"? Because if you have that (or STS), sslstrip doesn't work.<p>Key continuity's problems, on the other hand, <i>aren't</i> user interface issues. In key continuity schemes, when your browser is first introduced to a new website, you simply are insecure. If at that moment you are MITM'd by an attacker, you might never again be secure. This isn't a UI issue: key continuity protocols don't have the information available to them on first connection to make that decision.<p>Think to yourself, if you ran the great firewall of China, which system you'd rather have: the flawed one we have now, or the one that <i>explicitly allows your connection on the first and subsequent connections to a new service to be hijacked</i>?<p>I am our resident SSL/TLS apologist. But let me be clear that this deck is good, and raises a lot of valid concerns. I think SSL/TLS is a good system, but I share the (implied) disgust at the way our PKI has been managed. Some kind of reform is needed. I just don't think it needs to come with additional engineering sacrifices.