13throwaway

wget -O - "http://pastebin.com/raw.php?i=fA7z2BPi" | wge -i -

Alice sends Bob a link: http://example.com

Bob trusts Alice and now knows that example.com is probably ment to be accessed over HTTP. Now for the next example:

Alice sends Bob a link: https://example.com

With the current implementation of browsers Bob knows that example.com should present a CA signed certificate. But what if example.com wants to encrypt their data, but for whatever reason uses a self-signed certificate? Some people say that Bob's browser should not display a "big scary" warning, but instead display a UI similar to when accessing a HTTP site. However, in this situation HTTPS has lost some meaning. I think http2 should work as follows:

http2:// - encrypted, not verified

https2:// - encrypted and verified

This way the protocol still conveys the same level of information.

However, if it were completely up to me, I would say ditch the CAs and use namecoin to verify certificates.

In order to be an improvement over the CA model a new system would have to satisfy all 3 points of zooko's triangle. https://en.wikipedia.org/wiki/Zooko%27s_triangle