3 ms·
And? The provider can request a lets encrypt certificate for the same domain already, and then give Let's Encrypt a wrong IP. This allows the same provider to
by kuschku 9y ago
And?
The provider can request a lets encrypt certificate for the same domain already, and then give Let's Encrypt a wrong IP.
This allows the same provider to get a fake certificate, and MitM only specific users.
I don't see any additional attack surface.
- icebraining 9y agoYes, DANE is not necessarily worse than what we have right now. But what we have right now is what moxie is criticizing. His trust agility argument is for a new proposal (called Convergence), not to defend CAs vis-a-vis DANE.