3 ms·

DANE could make CAs obsolete, and the internet more secure: https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/w

• snowwrestler 7y ago
  It just moves the basis of trust from a diverse network of private CAs, any of which can be individually punished or distrusted if they misbehave, to the single centralized system of DNS, which rolls up to whomever controls your TLD of choice--entities who usually can't be removed, punished, or replaced.
  • tasuki 6y ago
    There's a blockchain project that attempts to decentralize TLDs - people would actually own their TLDs (by cryptography!), and would issue their own certificates. Only you and no one else would be able to issue a certificate for your TLD. I've been shilling for this project enough, and feel it's a little offtopic here, but if you're really interested you can find it in my recent post history :)
  • naniwaduni 6y ago
    Entities who also can de facto pull enough strings to authenticate to any CA as you, even under the existing system.
• Avamander 7y ago
  Frankly, that's bullshit. Now you have to trust your country or some other private entity, without all the protection mechanisms modern Web PKI has.
  • toast0 7y ago
    Lets Encrypt (and most other issuers) are happy to issue certificates to whoever controls the DNS for a domain, which could be your TLD administrator at their whim. I don't think DANE is going to make any progress, but opposing it because it gives TLDs more power is kind of bunk -- the TLDs already have that much power, DANE just makes it more explicit.