5 ms·
"Did you know that SSL/HTTPS in no way relies on a secure DNS today?" That's really too bad. It should. DNSSEC can handle providing CERTS. Using these CERTS
by onedognight 16y ago
"Did you know that SSL/HTTPS in no way relies on a secure DNS today?"
That's really too bad. It should. DNSSEC can handle providing CERTS. Using these CERTS and DNSSEC to validate them (on top of the rest of SSL/TLS) would be a secure and free way for domain owners to provide a better security than provided by SSL/TLS as implemented today.
SSL/TLS requests can be man-in-the-middled by any one with access to any of the 150 or so root keys in your browser including for example the governments of Taiwan and China. If we used CERT DNS records, then not only would we not have to pay additional money to VeriSign etc to have a CERT, but there would only be twoish keys that would allow man-in-the-middle attacks (the root DNS zone and the .com DNS zone for example). That is a significant improvement.
Does anyone know if any of the browsers have plans to provide DNS CERT support?
- tptacek 16y agoI love the suggestion that there is in fact a free lunch for company authentication; that we can simply replace a (very crappy) vetting system with a vending machine protocol and all our authentication problems will go away. As for the "150 root keys" issue: that is in fact a very good point. Remove the sketchy ones from your browser. Someone should publish a list --- "these ones are probably fine for people in the US to remove". Whoah. Look. I just solved that problem in 15 seconds, using the Firefox UI; it didn't even require an IETF working group to discuss it! ;)