3 ms·

At least the Libyan government can only MITM .ly in DANE world, and not a Libyan CA and consequently every other domain in existence.

• comex 7y ago
  Also, if the Libyan government decides they want to seize the domain of a popular link shortener (like the US government has seized some domains under US TLDs), they can just get a certificate from Let’s Encrypt. The Web PKI system isn’t really set up to stop them from doing that. The only scenario where the current CA system possibly has an advantage is if they apply their MitM covertly, only to a subset of clients. If this is discovered, CAs who participate in the scheme can be blacklisted, whereas with centralized control you’d have to basically blacklist all of .ly…
  • theamk 7y ago
    Let’s Encrypt participates in CT, so no, they won’t. This will be discovered, and (I guess) they will revoke the cert really quickly
    • comex 7y ago
      They might, but if so it would be a special exception from their usual policies. In general, deciding who owns a particular domain name is a matter for the corresponding TLD's registry. If NIC.LY decides to seize bit.ly, there's nobody that can declare that illegitimate per se, or force them to give it back. And to quote Wikipedia on the semantics of DV certificates (which are the normal kind): > The sole criterion for a domain validated certificate is proof of control over whois records, DNS records file, email or web hosting account of a domain.
• theamk 7y ago
  The big difference is that in DANE, they get to MITM forever. And in current world, the MITM will be discovered and country’s registrars disabled pretty quickly.