4 ms·
DNSSEC has a CA-like trust model. It's only a route to the same thing, but with weaker crypto, no Certificate Transparency, and no ability to distrust bad acto
by pornel 9y ago
DNSSEC has a CA-like trust model.
It's only a route to the same thing, but with weaker crypto, no Certificate Transparency, and no ability to distrust bad actors (distrusting Symantec's Verisign CA is feasible, but dropping Verisign's `.com` is not).
- andrius4669 9y ago>DNSSEC has a CA-like trust model. Not really. You cannot get .tk operator to sign .jp domain (unless they're both controlled by same authority, which usually isn't the case).
- tptacek 9y agoWho cares? The majority of commercially important domain names live under parts of the DNS hierarchy that are de jure controlled by the Five Eyes governments.