|
|
|
|
|
|
16
|
| [[How do I get a domain name?]] |
|
16
|
| [[How do I get a domain name?]] |
|
|
17
|
| [[How do I get a "real" SSL certificate?]] |
|
17
|
| [[How do I get a "real" SSL certificate?]] |
|
|
18
|
| [[Why use self-signed certificates?]] |
|
18
|
| [[Why use self-signed certificates?]] |
|
|
|
|
19
|
+| [[Why not use the services of $company instead? They took the Seppuku pledge]] |
|
|
19
|
#+END_CENTER
|
20
|
#+END_CENTER
|
|
20
|
|
21
|
|
|
21
|
* Why not supply a disk image download?
|
22
|
* Why not supply a disk image download?
|
|
|
|
|
|
|
182
|
Security of web sites on the internet is still a somewhat unsolved problem, and what we have now is a less than ideal but /good enough to fool most of the people most of the time/ kind of arrangement. Long term a better solution might be to have a number of certificate authorities in a number of different jurisdictions vote on whether a given certificate actually belongs to a given domain name. Experimental systems like this exist, but they're not widely used. Since the current certificate system has an enormous amount of inertia behind it change could be slow in arriving.
|
183
|
Security of web sites on the internet is still a somewhat unsolved problem, and what we have now is a less than ideal but /good enough to fool most of the people most of the time/ kind of arrangement. Long term a better solution might be to have a number of certificate authorities in a number of different jurisdictions vote on whether a given certificate actually belongs to a given domain name. Experimental systems like this exist, but they're not widely used. Since the current certificate system has an enormous amount of inertia behind it change could be slow in arriving.
|
|
183
|
|
184
|
|
|
184
|
For now a self-signed certificate will probably in most cases protect your communications from "bulk" passive surveillance. Once you've got past the scary browser warning and accepted the certificate under most conditions (except when starting up the Tor browser) you should not repeatedly see that warning. If you do then someone may be trying to meddle with your connection to the server. You can also take a note of the fingerprint of the certificate and verify that if you are especially concerned. If the fingerprint remains the same then you're probably ok.
|
185
|
For now a self-signed certificate will probably in most cases protect your communications from "bulk" passive surveillance. Once you've got past the scary browser warning and accepted the certificate under most conditions (except when starting up the Tor browser) you should not repeatedly see that warning. If you do then someone may be trying to meddle with your connection to the server. You can also take a note of the fingerprint of the certificate and verify that if you are especially concerned. If the fingerprint remains the same then you're probably ok.
|
|
|
|
186
|
+* Why not use the services of $company instead? They took the Seppuku pledge
|
|
|
|
187
|
+[[http://seppuku.cryptostorm.org][That pledge]] is utterly worthless. Years ago people trusted Google in the same sort of way, because they promised not be be evil and because a lot of the engineers working for them seemed like honest types who were "/on our side/". Post-[[https://en.wikipedia.org/wiki/Nymwars][nymwars]] and post-[[https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29][PRISM]] we know exactly how much Google cared about the privacy and security of its users. But Google is only one particular example. In general don't trust pledges made by companies, even if the people running them seem really sincere.
|
Bob Mottram
10 年 前