3 ms·
TLSA DNS records coupled with DNSSEC could eliminate the need for CAs but we still have a long way to go until we can rely on it.
by foepys 9y ago
TLSA DNS records coupled with DNSSEC could eliminate the need for CAs but we still have a long way to go until we can rely on it.
- hsivonen 9y agoDNSSEC has a 1024-bit RSA root after Web PKI ( at least Mozilla-flavored) no longer did. Are the TLDs audited like CAs? Having to change the domain name to evade the TLDs bad security practices is more disruptive than switching CAs.
- mastax 9y agoThen you just move all the WoT issues of the CA system into DNS, no?
- foepys 9y agoYes. But you could argue that securing DNS is necessary anyways and using it for TLS is just the next step.