3 ms·
I keep seeing this argument that dnssec/dane puts more power in the hands of registrars, which are not as trustworthy as CAs. Aren't most TLS certs domain vali
by Abekkus 7y ago
I keep seeing this argument that dnssec/dane puts more power in the hands of registrars, which are not as trustworthy as CAs.
Aren't most TLS certs domain validated anyways? The current TLS practice already puts full trust in registrars AND CAs.
Also, complaints that registrars can quietly change out sites without anyone noticing, is pretending that we cannot watch the state of the DNS over time. Don't we have certificate transparency already to solve a similar problem in the WebPKI?
- marcosdumay 7y agoYes, on DNSSEC the people that can impersonate your site is a strict subset of the people that can do so on TLS. But I'm not sure certificate transparency will work as well for DNS as it does for TLS. At least not without some changes (that are a good idea for many other reasons) like permitting SRV for HTTP.