4 ms·

You really think that giving Libya the keys to bit.ly, for example, is a step forward?

• toast0 11y ago
  Doesn't Libya already have the keys? They can redelgate the zone and get a domain controlled cert. Or probably something more subtle with selective who is responses.
  • tptacek 11y ago
    No! Choosing a .LY name for your website does not give the government of Libya your TLS keys. With DNSSEC, that could change.
    • toast0 11y ago
      If the operator of .LY might takeover the domain to return DANE records that it controls, why wouldn't it takeover the domain and procure a domain validated certificate from a CA? For extra sneakyness, they could probably return the regular glue records and whois information to most requestors, and poisoned values to the targeted CA, to get the certificate up an running in advance of hijacking the domain in general.
      • tptacek 11y ago
        CAs are insecure. Nobody is arguing otherwise. The problem is that you can't mitigate insecure CAs by adding a new set of irrevocable government-controlled CAs. That's the point 'idlewords is making. Right now, the DNS does not function as a sort of distributed CA. But that's exactly what DNSSEC asks it to do.
        • toast0 11y ago
          For domain validated certificates, the DNS does essentially function as a sort of distributed CA; if you control the DNS for a domain, you can get the certificate issued: this isn't insecure, it's by design. Unless we're talking about removing domain validated certificates, I don't see why explicitly treating DNS as a CA, when it's a de facto CA is a problem. I'm not sure how we can get to HTTPS everywhere without domain validated certificates?