alt Hacker News"... and the whole system doesn't even work because certificates are issued over plaintext connections, and trusted certificate aurthorities[sic] use very secure keys like "4""
And the CA certificate is "self-signed"
Meanwhile under this "Web PKI" the www user is by default discouraged and/or blocked from using self-signed certificates she herself creates
Someone else decides who she must trust. It's not optional
For example, for a number of years someone else told her she must trust eMudhra
Replies
I mean some people can and do remove entries in their trust store. I imagine there's a very near future where someone inclined could have a perfectly serviceable internet experience with nearly all of them removed.
Unfortunately, smart internet users are outnumbered by not so smart users thousands to one. And the not so smart users aren't smart enough to know every time when a website is or isn't trustworthy. So while far from ideal, the world is a much better place since we gave control of the entire internet to a few aristocrats.
Of course that argument got heavily undermined by the existence of Let's Encrypt.
Yes, one can remove certificates from a "trust store" in a folder (in practice, usually a "bundle" maintained by a browser vendor, or something derived therefrom)
But how does the www user remove a certificate that's compiled into a popular browser
The popular browsers, maintained by companies invested in internet surveillance advertising, is so large and complex that in practice few will edit and compile it themselves. Not only is certificate removal impractical but user-signed certificates outside the browser will usually trigger multiple warnings, even requiring users to type shibboleths to be detected by keyloggers
This "Web PKI" system presumes no www user can _ever_ trust themselves to make trust decisions. It's presumed that this is _never_ an option for _any_ user, in any situation