- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
Mozilla: Everyone's scared of hackers but clueless about fending them off
|
|
|
Comments (1)
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post
Encryption while 'online' could mean:
- Checking that server to client traffic is encrypted via TLS by observing the https lock indicator
- Encrypting email using either x509 or PGP keys.
- Encrypting uploaded personal data using either x509 or PGP
- Checking DNSSEC signatures via the appropriate browser extension
- Any number of and/or combination of employing cryptographic signatures and encryption techniques
In my view, use of strong cryptographic techniques have been stymied by the preference of x509 keys signed by CAs as the default identity assurance model. There's also the muddied waters over 'certificates' versus 'keys'... these things are the same thing. A certificate is a signed public key. There is no cryptographic difference between an x509 cert and a signed PGP key. Both are public keys that have been cryptographically signed. The main difference between x509 and PGP is the trust model of the signatures on the public keys. However, there is no reason a PGP key can't be signed by a corporation, government, or trusted domain and used the same way as an x509 public key is used... to establish a trust root.So... what about 'encryption' use online? What does that mean anyway?
The main issue is not encryption, it is trust in the cryptographic signatures contained on public keys.