4 ms·
I agree the whole design is horrible. I would much rather have had no DNS records whatsover, and instead used onion-style layered TLS, rather like how 802.1X wo
by chaz6 6y ago
I agree the whole design is horrible. I would much rather have had no DNS records whatsover, and instead used onion-style layered TLS, rather like how 802.1X works with outer and inner authentication. The browser would first initiate a TLS connection to the IP address, using the IP address as subject name. It then creates a second connection inside the first using the domain name as subject name.
- fpoling 6y agoHow the authenticity of IP address is established then? Wouldn’t the server need a certificate for its IP?
- corty 6y agoEither for its IP or for the hostname that results from the reverse-lookup of the IP. The latter is easier to obtain (proof of ownership for IPs is cumbersome) and is often present anyways. It would need an additional DNS lookup, but the present suggestion involving SVCB would need that as well (along with all the other uglyness).