Launching in 2015: A Certificate Authority to Encrypt the Entire Web
This certificate industry has been such a racket. It's not even tacit that there are two completely separate issues that certificates and encryption solve.  They get conflated and non technical users rightly get confused about which thing is trying to solve a problem they aren't sure why they have.<p>The certificate authorities are quite in love that the self-signed certificate errors are turning redder, bolder, and bigger.  A self signed certificate warning means "Warning! The admin on the site you're connecting to wants this conversation to be private but it hasn't been proven that he has 200 bucks for us to say he's cool".<p>But so what if he's cool?  Yeah I like my banking website to be "cool" but for 200 bucks I can be just as "cool".  A few years back the browsers started putting extra bling on the URL bar if the coolness factor was high enough - if a bank pays 10,000 bucks for a really cool verification, they get a giant green pulsating URL badge.  And they should, that means someone had to fax over vials of blood with the governor's seal that it's a legitimate institute in that state or province.  But my little 200 dollar, not pulsating but still green certificate means "yeah digitalsushi definitely had 200 bucks and a fax machine, or at least was hostmaster@digitalsushi.com for damned sure".<p>And that is good enough for users.  No errors?  It's legit.<p>What's the difference between me coughing up 200 bucks to make that URL bar green, and then bright red with klaxons cause I didn't cough up the 200 bucks to be sure I am the owner of a personal domain?  Like I said, a racket.  The certificate authorities love causing a panic.  But don't tell me users are any safer just 'cause I had 200 bucks.  They're not.<p>The cert is just for warm and fuzzies.  The encryption is to keep snoops out.  If I made a browser, I would have 200 dollar "hostmaster" verification be some orange, cautious URL bar - "this person has a site that we have verified to the laziest extent possible without getting sued for not even doing anything at all".  But then I probably wouldn't be getting any tips in my jar from the CAs at the end of the day.