3 ms·

I don't see how that would be a significant improvement though. Firstly, given how many domain registries and registrars there are, there still would be a ton

by Cyph0n 10y ago

I don't see how that would be a significant improvement though. Firstly, given how many domain registries and registrars there are, there still would be a ton of trust roots (probably way more than 391). Secondly, this would significantly increase the difficulty of managing a domain registrar, and would probably lead to decreased competition in the space (more expensive domains?). And thirdly, the client would still need to manage trusted certificates locally, so client-side complexity is unchanged. Most importantly, the benefits of a new system must vastly outweigh the cost of migrating to it.

xorcist 10y ago
The registry/registrar system may not be perfect, but that's what we have (and there is an appeals process). It's not as bad as you make it seem. You can not redelegate google.com for example, even if you work at a registrar. Whereas any CA could generate a new certificate, today. As long as domains are what you generate certificates for you might as well assert that delegation in a cryptographically secure way. It may also be a good basis to make domain transfers more secure.