3 ms·
There seems to be this mistaken belief that DNSSEC/DANE are intended to replace CAs. There is no such idea. I wrote about this recently if you're interested. h
by AndyMcConachie 11y ago
There seems to be this mistaken belief that DNSSEC/DANE are intended to replace CAs. There is no such idea.
I wrote about this recently if you're interested.
http://metafarce.com/adventures-in-dane/ http://metafarce.com/adventures-in-dane/
"..the purpose of DANE is not to do away with the CA system. It is to provide another chain of trust based on the DNS hierarchy."
- inopinatus 11y agoIf only intentions made the world go round. But how we use things, and build upon them, is often rather more interesting than what someone intended. The commercial CAs will be a relic. It's only a matter of time before the whole house of cards collapses. The price pressure has been downwards for years. EV is not meaningful to most end-users, remaining a money-printing scam that provides little assurance of safety (if Enron, or Ashley Madison could get one, what's it worth?), and is vulnerable to MITM and rebinding attacks[1]. I anticipate that Amazon's CA[2] could undermine the profitability - and via desperation, the integrity - of the whole sector even further. [1] http://www.blackhat.com/presentations/bh-usa-09/ZUSMAN/BHUSA09-Zusman-AttackExtSSL-SLIDES.pdf http://www.blackhat.com/presentations/bh-usa-09/ZUSMAN/BHUSA... [2] http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-certificate-provider-applies-to-be-a-root-certifcate-authority/ http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-cer...
- realityking 11y agoHow is it relevant that Enron or Ashley Madison could get EV certificates? They are intended to proof that you're communicating with whom you intended to communicate. They make no claim about the trustworthiness of the company itself (and how would you even test that?)