5 ms·

It'd be nice if we could distrust the whole CA system and start from scratch. (of course, to everyone who is saying to themselves that this is absurd and unreal

It'd be nice if we could distrust the whole CA system and start from scratch. (of course, to everyone who is saying to themselves that this is absurd and unrealistic.. yes, of course you're right.. for the moment.) It seems pretty clear that the future lies in the blockchain.

dpark 10y ago
How does the blockchain solve the problems with CAs?
- pfg 10y ago
  Haven't you heard, you can solve any problem by throwing a blockchain at it! ;-) On a more serious note, Certificate Transparency, which will become mandatory in Chrome in about a year, uses technology that is strongly related to blockchains, so we're really not too far from a blockchain-like solution for the Web PKI.
  - Torgo 10y ago
    A global, permanent, public, append-only log for 11 cents a record is pretty useful.
  - schoen 10y ago
    I agree that CT uses a technology related to blockchains, but as I noted above, Ben Laurie has been pretty vocal in saying that the Bitcoin-style PoW blockchain isn't a technology that he favors, and I think he thinks CT is importantly different in some respects (for example in accepting more centralization in the operation of logs: an uninvolved anonymous party can't show up and "mine" a CT log event). http://www.links.org/files/decentralised-currencies.pdf http://www.links.org/files/decentralised-currencies.pdf
- throwaway7767 10y ago
  Not the OP, but I imagine he has something like namecoin in mind. Domains are tied to cryptographic keys which are also used for encryption+authentication, and the blockchain stores the mapping of names to keys. It's not ready for primetime, and it has its own issues. I don't really see it gaining much traction. But it does present an alternative approach to the problem.
  - dpark 10y ago
    How do you tie a domain to a key in this model? That's the specific thing that CAs do. The Wikipedia article seems to hand wave over this and I don't see an obvious answer on the namecoin site (though I assume it's there if I dig enough).
    - detaro 10y ago
      I don't know if there are established formats to do it, but you would publish the public key in the namecoin record of your domain. You can only do that if you currently own the name in the namecoin chain, similar to how DANE would put a key into DNS.
    - deleted 10y ago
      [deleted]
    - heheocoenev 10y ago
      You register a domain by spending namecoin in a reg tx, which becomes immutable in the bc. Problem is that when a court says Cocacola.blockchain_namespace is the legal property of the Coke, and the owner is some kid in China who won't hand over the keys, no Corp would use it for DNS. Names should be strong to prevent spoofing but not so strong that squatters and unlawful holders of keys can disrupt their legitimacy.
      - dpark 10y ago
        So basically it doesn't at all solve the problem. Immutable domain names are not a good thing in general (though certainly in specific cases it could be), especially when as you noted squatting is inevitable.
hannob 10y ago
That's pretty much what Google announced today: https://news.ycombinator.com/item?id=12784295 https://news.ycombinator.com/item?id=12784295 (Certificate Transparency is basically a Blockchain. And this may be one of the few cases where a blockchain-like technology actually makes sense.)
- schoen 10y ago
  Ben Laurie, who co-invented CT, claims not to favor blockchains (especially with proof-of-work), e.g. http://www.links.org/files/decentralised-currencies.pdf http://www.links.org/files/decentralised-currencies.pdf He seems to have argued that CT's log works on different principles, although surely it's influenced by all of the revitalized consensus work that's happened after the Bitcoin paper.

dpark 10y ago

How does the blockchain solve the problems with CAs?

pfg 10y ago
Haven't you heard, you can solve any problem by throwing a blockchain at it! ;-) On a more serious note, Certificate Transparency, which will become mandatory in Chrome in about a year, uses technology that is strongly related to blockchains, so we're really not too far from a blockchain-like solution for the Web PKI.
- Torgo 10y ago
  A global, permanent, public, append-only log for 11 cents a record is pretty useful.
- schoen 10y ago
  I agree that CT uses a technology related to blockchains, but as I noted above, Ben Laurie has been pretty vocal in saying that the Bitcoin-style PoW blockchain isn't a technology that he favors, and I think he thinks CT is importantly different in some respects (for example in accepting more centralization in the operation of logs: an uninvolved anonymous party can't show up and "mine" a CT log event). http://www.links.org/files/decentralised-currencies.pdf http://www.links.org/files/decentralised-currencies.pdf
throwaway7767 10y ago
Not the OP, but I imagine he has something like namecoin in mind. Domains are tied to cryptographic keys which are also used for encryption+authentication, and the blockchain stores the mapping of names to keys. It's not ready for primetime, and it has its own issues. I don't really see it gaining much traction. But it does present an alternative approach to the problem.
- dpark 10y ago
  How do you tie a domain to a key in this model? That's the specific thing that CAs do. The Wikipedia article seems to hand wave over this and I don't see an obvious answer on the namecoin site (though I assume it's there if I dig enough).
  - detaro 10y ago
    I don't know if there are established formats to do it, but you would publish the public key in the namecoin record of your domain. You can only do that if you currently own the name in the namecoin chain, similar to how DANE would put a key into DNS.
  - deleted 10y ago
    [deleted]
  - heheocoenev 10y ago
    You register a domain by spending namecoin in a reg tx, which becomes immutable in the bc. Problem is that when a court says Cocacola.blockchain_namespace is the legal property of the Coke, and the owner is some kid in China who won't hand over the keys, no Corp would use it for DNS. Names should be strong to prevent spoofing but not so strong that squatters and unlawful holders of keys can disrupt their legitimacy.
    - dpark 10y ago
      So basically it doesn't at all solve the problem. Immutable domain names are not a good thing in general (though certainly in specific cases it could be), especially when as you noted squatting is inevitable.

hannob 10y ago

That's pretty much what Google announced today: https://news.ycombinator.com/item?id=12784295 https://news.ycombinator.com/item?id=12784295 (Certificate Transparency is basically a Blockchain. And this may be one of the few cases where a blockchain-like technology actually makes sense.)

schoen 10y ago
Ben Laurie, who co-invented CT, claims not to favor blockchains (especially with proof-of-work), e.g. http://www.links.org/files/decentralised-currencies.pdf http://www.links.org/files/decentralised-currencies.pdf He seems to have argued that CT's log works on different principles, although surely it's influenced by all of the revitalized consensus work that's happened after the Bitcoin paper.