Centralized CAs were and are a mistake. HTTPs should work more like ssh-keys where the first time you connect to a website it’s untrusted, but once you have validated it the website you want, it never bothers you again unless the private key changes. Private key rotations can be posted on public forums, or emailed, or any number of other ways and users that don’t care can ignore the warnings like they do anyway, while users who DO care, can perform their own validation through other channels.
The most important aspect is that there is no “authority” that can be corrupted, except for the service you are connecting to.
There is no way a user can know that their traffic hasn’t been man-in-the-middled by a compromised CA either. And why is it “disastrous” to trust a website after you have cryptographically verified its the same website you visited before? It would present the same public/private key pair that you already trust.
That’s where the SSH analogy comes from. On the initial connection you get the signature of the web-site you are trying to visit and your browser trusts it from then on. If something changes later, then the scary warning comes up.
Ive heard of it, and want to use it, but unfortunately the only reason Im still sticking with instagram is because I have very dear friends who would never change to anything non-mainstream.
This is called the network effect, it’s a social problem and no amount of technology will solve this. So your choices are either to stop using apps where you are the product, and obviously convince your friends to stop that as well, or grin and bear it. Maybe think about what you did 20 years ago and do that instead.
Yes, also Teslas (media.mastodon.scot)
Article 45 Will Roll Back Web Security by 12 Years (www.eff.org)
Meta payment message (iusearchlinux.fyi)
So I got the message from instagram about either paying or using it free (at the cost personalised ads) just now....