3 ms·
> Also, what stops governments to fully replace your domain with their own, including valid certs? The threat is doing this but only for a small number of peop
by hdhzy 10y ago
> Also, what stops governments to fully replace your domain with their own, including valid certs?
The threat is doing this but only for a small number of people. That could go unnoticed if they could provision certs in the dns. If a CA issues bad cert you see it in CT logs and the CA gets punished.
- okket 10y agoIt can only go unnoticed if you do not check your DNS and your certs via monitoring. You should absolutely do this, even if it is just to be sure you didn't mess something up by accident. If a government acting malevolent on a top level domain is detected, alarm bells should ring. Avoid, avoid, avoid. There are enough other TLDs available, with other governments and different threat levels.
- tptacek 10y agoIf you truly believe this, then DANE on .COM domains is already a nonstarter, because the DOJ has been compromising the "integrity" of the .COM zone (stipulating that it has any "integrity" to begin with) for many years in the service of various public policy objectives. Which TLD should Google move to, where they'll be safe from this kind of interference? How should they transition? You can't simply redirect from .COM to the new domain.