3 ms·

I don't think it makes sense to force every domain owner on the planet who wants HTTPS to understand how to generate, store, use, and maintain (more) public/pri

I don't think it makes sense to force every domain owner on the planet who wants HTTPS to understand how to generate, store, use, and maintain (more) public/private keys, especially in a secure manner. Having to deal with SSL certificates is enough of a pain already, and for this one you'd have to use another program to sign requests, so there's an added layer of pain. In fact, I don't think it makes sense to add to the burden of domain owners so much at all, even if they could all do this. Not to mention that, more practically there's no need (and potentially possible harm) to tie the ownership records to a particular cipher. Really, it's the registrar's job to deal with domain ownership; ideally it shouldn't involve you at all. And as a near-corollary, they could probably deal with long-term key security better than the average domain owner.

hueving 9y ago
Ok, then we need to stop using DNS. Your record server being compromised shouldn't be able to imply ownership.
- kuschku 9y ago
  Or we should require DNSSEC for DV certificates.
  - IncRnd 9y ago
    You're right that something should be used, but DNSSEC is a weak solution from a security point of view.
- mehrdadn 9y ago
  I... agree? In fact that's quite literally what I was saying?
heavenlyblue 9y ago
I think it does make sense. If they can't do it themselves then let them hire someone who'll do this for them.
- mehrdadn 9y ago
  > I think it does make sense. If they can't do it themselves then let them hire someone who'll do this for them. Really? In your mental model is (or should be) every domain owner overflowing with money?
  - heavenlyblue 9y ago
    In my mental model the requirements of the modern web are way above what was in the 1990s. A single static landing page would be expected to have at least traffic tracking, at least for the sake of load-balancing. Even if the page is that - just a static page, the chance it's hosted by the content owner themselves is becoming smaller every day. So frankly - yes. I believe today is the right time to start adding/replacing layers in the stack. After all - we've gone a long way in terms of software deployment tools so it's way more interchangeable.

hueving 9y ago

Ok, then we need to stop using DNS. Your record server being compromised shouldn't be able to imply ownership.

kuschku 9y ago
Or we should require DNSSEC for DV certificates.
- IncRnd 9y ago
  You're right that something should be used, but DNSSEC is a weak solution from a security point of view.
mehrdadn 9y ago
I... agree? In fact that's quite literally what I was saying?

heavenlyblue 9y ago

I think it does make sense. If they can't do it themselves then let them hire someone who'll do this for them.

mehrdadn 9y ago
> I think it does make sense. If they can't do it themselves then let them hire someone who'll do this for them. Really? In your mental model is (or should be) every domain owner overflowing with money?
- heavenlyblue 9y ago
  In my mental model the requirements of the modern web are way above what was in the 1990s. A single static landing page would be expected to have at least traffic tracking, at least for the sake of load-balancing. Even if the page is that - just a static page, the chance it's hosted by the content owner themselves is becoming smaller every day. So frankly - yes. I believe today is the right time to start adding/replacing layers in the stack. After all - we've gone a long way in terms of software deployment tools so it's way more interchangeable.