Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Thanks for clarifying.

There is value in a higher barrier to entry. That much is seen in almost every place that has such barriers. Nintendo games are typically high quality and App Store apps are usually not (and Play Store -- not picking on anyone). I've seen much higher quality from sites hosted by regular hosting companies (and paid-for domains) than I do from sites like mysite.site99.commish.ru (if you'll excuse the exaggerated example). Self-signed is even worse than my exaggerated example when it comes to trustworthiness because there are far too many bad actors who want to do bad things but also don't have $100USD to spend on a cert. I don't doubt that some kind of better system can exist but self-signed is definitely less trustworthy.



From what I understand, and as I said I don't know much, the purpose of not self-signed certs is to provide trustworthy information about identity of entity that controls the domain.

I think that only government that issues my ID is the only party that can confirm my identity, so it, rather than private corporation should sign my cert only after it verifies my identity in the same way it would if for example I would testify in court.

If I wan't to associate cert with a company, only the office that registered my company can provide meaningful assurance about identity of my company.

The security of the system for propagating this assurance of identity of entity should not rely in any way on authority of any entity, public or private.

Also the assurances should be explicit. If someone confirms that I paid the utility bill for given address should only say that they confirm that I did that, not that I live there.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: