4 ms·
Forgive an uninformed comment, but isn't DNSSEC the only viable route away from globally trusted CAs? And the CA model is just fundamentally wrong in many ways
by TorKlingberg 9y ago
Forgive an uninformed comment, but isn't DNSSEC the only viable route away from globally trusted CAs? And the CA model is just fundamentally wrong in many ways (still better than nothing or trust on first use though).
- pornel 9y agoDNSSEC has a CA-like trust model. It's only a route to the same thing, but with weaker crypto, no Certificate Transparency, and no ability to distrust bad actors (distrusting Symantec's Verisign CA is feasible, but dropping Verisign's `.com` is not).
- andrius4669 9y ago>DNSSEC has a CA-like trust model. Not really. You cannot get .tk operator to sign .jp domain (unless they're both controlled by same authority, which usually isn't the case).
- tptacek 9y agoWho cares? The majority of commercially important domain names live under parts of the DNS hierarchy that are de jure controlled by the Five Eyes governments.
- marcosdumay 9y agoThe TLS CA has some functionality specified for non-global trust. It is just that nobody implements it.