why do people still fall for the X.509 scam? like its not even just laymen mashing buttons on their phone, even all the so called open source hackers are fine with it.
i remember when i first learned of the existence of crypto 15 or 20 years ago, i setup a website with SSL/TLS that was only used by me and a few international peers. but immediately i realized just adding the website's cert to the browser probably doesnt make the browser _require_ it. so any CA or someone who hacked any single one of them could just generate their own cert and MITM my own website across the hall from me. and all my buddies who i each gave a client cert as well as the server's cert also for some reason could not tell their browser the right public key to expect from the website, even though we were already talking on pre-established end to end encrypted channels.
it was so confusing, after just learning about public key crypto, the most important thing is distributing the public key properly, but i could not find a single way to tell a browser to use a specific public key for a specific website. of course in hind sight the answer is obvious and is that the browser wants you to buy into their nonsensical system of random "authorities" saying which public key is right for which domain, and there simply is no supported way to do things properly. this lead me to other questions: if you accept a self signed cert from some random website and that cert has a CA in it, does that become in your CA list (obviously now with a million clout chasers looking for web vulns, this wont be the case, but back then you could never be sure. it probably even was the case at one point, given how dumb most HTTPS vulns are).
oh yeah, and X.509 has a million config options, none of which you can tell are making your server insecure without becoming an expert on X.509. at the time i saw all kinds of stupid soykaf like allowing known soykaf algos, "export crypto", etc that i all disabled. who knows it probably just introduced different vulns because of how complex SSL/TLS is
in other words, what i expected was pic related, while instead i got some roundabout "user friendly" snakeoil that is just more complicated in the long run
but here's the thing, i only wasted a day or 2 on this, then we realized X.509 is for niggers and we settled on using SSH tunnels to access the website