3 ms·

Is there even a viable and scalable alternative? Genuine question.

by Cyph0n 10y ago

xorcist 10y ago
By using the existing domain allocation system. Sign all delegations of domains, and use this assertion to build TLS trust. As long as TLS certificates sign domain names you trust that delegation, so having an alternate trust root is stupid (and having 391 of them is beyond stupid).
- Cyph0n 10y ago
  I don't see how that would be a significant improvement though. Firstly, given how many domain registries and registrars there are, there still would be a ton of trust roots (probably way more than 391). Secondly, this would significantly increase the difficulty of managing a domain registrar, and would probably lead to decreased competition in the space (more expensive domains?). And thirdly, the client would still need to manage trusted certificates locally, so client-side complexity is unchanged. Most importantly, the benefits of a new system must vastly outweigh the cost of migrating to it.
  - xorcist 10y ago
    The registry/registrar system may not be perfect, but that's what we have (and there is an appeals process). It's not as bad as you make it seem. You can not redelegate google.com for example, even if you work at a registrar. Whereas any CA could generate a new certificate, today. As long as domains are what you generate certificates for you might as well assert that delegation in a cryptographically secure way. It may also be a good basis to make domain transfers more secure.
- Tharkun 10y ago
  Why would you trust DNS roots more than CAs?
  - xorcist 10y ago
    You always have to trust the DNS, unless you use certificates for something else. (The exception being EV certificates, but it is far from clear how many end users know or care about that.) So the question should be why trust DNS and CA when the DNS is sufficient? And it doesn't have to be DNS, you could use domain names for other things too, but DNS is what end users care about so that's where you need to start.
jMyles 10y ago
I view both Namecoin and CJDNS as viable alternatives, and both are less flawed than the CA system.

Is there even a viable and scalable alternative? Genuine question.

by Cyph0n 10y ago

Is there even a viable and scalable alternative? Genuine question.

By using the existing domain allocation system. Sign all delegations of domains, and use this assertion to build TLS trust. As long as TLS certificates sign domain names you trust that delegation, so having an alternate trust root is stupid (and having 391 of them is beyond stupid).

Cyph0n 10y ago
I don't see how that would be a significant improvement though. Firstly, given how many domain registries and registrars there are, there still would be a ton of trust roots (probably way more than 391). Secondly, this would significantly increase the difficulty of managing a domain registrar, and would probably lead to decreased competition in the space (more expensive domains?). And thirdly, the client would still need to manage trusted certificates locally, so client-side complexity is unchanged. Most importantly, the benefits of a new system must vastly outweigh the cost of migrating to it.
- xorcist 10y ago
  The registry/registrar system may not be perfect, but that's what we have (and there is an appeals process). It's not as bad as you make it seem. You can not redelegate google.com for example, even if you work at a registrar. Whereas any CA could generate a new certificate, today. As long as domains are what you generate certificates for you might as well assert that delegation in a cryptographically secure way. It may also be a good basis to make domain transfers more secure.
Tharkun 10y ago
Why would you trust DNS roots more than CAs?
- xorcist 10y ago
  You always have to trust the DNS, unless you use certificates for something else. (The exception being EV certificates, but it is far from clear how many end users know or care about that.) So the question should be why trust DNS and CA when the DNS is sufficient? And it doesn't have to be DNS, you could use domain names for other things too, but DNS is what end users care about so that's where you need to start.

jMyles 10y ago

I view both Namecoin and CJDNS as viable alternatives, and both are less flawed than the CA system.