9 ms·

This article (really it's more of a press release from the interested parties) seems to confuse the role of DNS from the role of certificate authority, making i

This article (really it's more of a press release from the interested parties) seems to confuse the role of DNS from the role of certificate authority, making it hard for me to understand what they're talking about. These days sometimes the same entities provide both SSL certificates and DNS, but they are different services. > Handshake is “is effectively a decentralized domain name server,” Roquerre said. Instead of using the web-standard certificate authority to authenticate user connections to a server, Handshake stores references to the IP address of the websites registered in its system. Namebase is a platform that offers users access to the Handshake network That makes no sense at all. But it sounds like handshake is simply an alternate DNS protocol? Or does it also serve as a certificate authority somehow? Is it actually more decentralized than DNS (which is already of course decentralized in one axis, but not the relevant one for keeping a lookup available if the entity hosting DNS decides to remove it). Very confusing. It seems like tor .onion address would be an actually mature solution to this problem, instead of this thing that seems like press release babble?

troquerre 6y ago
The article has a few technical mistakes in it (I've found most publications do that when it comes to a technical subject I'm familiar with...), but in short Handshake is an alternative decentralized DNS root hosted on a blockchain. It aims to replace Certificate Authorities as the root of trust by pinning TLSA keys directly on the blockchain instead of relying on trusted parties for verfication.
- jrochkind1 6y ago
  So it aims to replace both DNS (a way of looking up IP address for a hostname) as well as certificate authorities (a way of knowing if the SSL cert being used by your connection is 'good')? Its an alternative DNS, with a method to use that alternative DNS as a way of authorizing ssl certs too?
  - troquerre 6y ago
    That's right! Though the infrastructure for HTTPS without CAs on Handshake is still nascent (the community welcomes contributors if you're interested!). This article covers how to set up HTTPS on Handshake using DANE https://medium.com/@ca98am79/how-to-view-dane-tlsa-websites-on-handshake-with-firefox-f55eb1dd5be9 https://medium.com/@ca98am79/how-to-view-dane-tlsa-websites-...
- koheripbal 6y ago
  Which blockchain? It's own or will they use Bitcoin's blockchain?
buffrr 6y ago
I think what they meant is that with decentralized DNS, it is possible to replace certificate authorities by using DNSSEC + DANE RFC6698[0], but I agree the way it's mentioned is confusing. [0] https://tools.ietf.org/html/rfc6698 https://tools.ietf.org/html/rfc6698
- jrochkind1 6y ago
  ok. obviously you can replace cert authorities with those systems on present DNS too, it doesn't require a "(more) decentralized DNS", right? Replacing cert authorities with something DNS-based (or alternative decentralized DNS based) doesn't actually seem relevant to the problem they are highlighting, of sci-hub's DNS records being removed by private or government actors making it harder to find sci-hub... no?
  - buffrr 6y ago
    To answer your first question, with the present DNS, If you use DANE, the trust is centralized since you have to trust the root DNS keys and the registrar (imo still better than trusting a large number of CAs. letsencrypt already relies on DNS to issue certificates).
- KirillPanov 6y ago
  > with decentralized DNS, it is possible to replace certificate authorities by using DNSSEC In what sense is DNSSEC decentralized? IMHO signing the root zone is about the most-centralizing thing that has ever happened to the Internet.
  - tptacek 6y ago
    It is exactly that.
  - tasuki 6y ago
    That's the thing Handshake is trying to address: with the root zone being on the (decentralized) blockchain, each TLD owner has full control over issuing the certificates for that domain using DNSSEC+DANE. The idea was that this would allow us to get rid of both the centralized root zone and CAs.
leephillips 6y ago
I agree. I found the article pretty incoherent, and gave up after a few paragraphs.
rasengan 6y ago
> But it sounds like handshake is simply an alternate DNS protocol? Handshake [1] is the next generation of DNS, as opposed to the ICANN controlled legacy system. It is more decentralized since a single actor does not control the system. You cannot be de-platformed without the consensus of the community and a fork, as opposed to a decision made by a single or small group of actors. > Or does it also serve as a certificate authority somehow? Since you can verify a certificate against a DANE TLSA record which is retrievable from a DNS zone with DS records stored on chain, the CA is no longer required for trust -- only cryptography. Checkout the paper which goes into far more detail [2]. The entire system actually incentivizes the Internet to become more secure -- which is pretty exciting! > Is it actually more decentralized than DNS It's more decentralized than DNS in that the root becomes the blockchain instead of ICANN. This project simply finishes the beautiful DNS ecosystem, which was already decentralized, other than the root. Now we are all root, democratically. [1] https://www.youtube.com/watch?v=Q3QbXMFjro0 https://www.youtube.com/watch?v=Q3QbXMFjro0 [2] https://handshake.org/files/handshake.txt https://handshake.org/files/handshake.txt
1vuio0pswjnm7 6y ago
This appears to be just another commercialisation of domain names, trying to create another "Gold Rush" for the most sought after "vanity" names. Winner-take-all. A few profit at the expense of the many. It perpetuates that problem of ICANN DNS becoming a "business" instead of solving it. (ICANN DNS domain names were originally free.) The potential for censorship is only one problem of ICANN DNS. Also, this project introduces a new problem of wasting energy on mining tokens.
- rasengan 6y ago
  > This appears to be just another commercialisation of domain names, trying to create another "Gold Rush" for the most sought after names. Winner-take-all. A few profit at the expense of the many. This is a major problem that the project has made a sincere attempt to address. Through scarcity certain sybil protections are afforded, which has been inherently architected into the consensus protocol [1]. Additionally, an airdrop to many internet pioneers and open source developers was built in as well, giving everyone similar resources to participate in the auction system which, in turn, affords everyone more equality in participation. Finally, the top 100k names as per alexa were pre-reserved for the holders in the alexa list, and these sites are incentivized to properly setup DNSSEC, as that's the only way they can claim their name on handshake. This is a win for internet security and internet users. It's absolutely a big win for freedom of speech. [1] https://handshake.org/files/handshake.txt https://handshake.org/files/handshake.txt
  - tptacek 6y ago
    I feel obliged to point out again that this project appears to be a cryptocurrency scheme in which the owners are, in essence, selling the DNS naming hierarchy, which is genius since they do not in fact own it. Also, once again, I'd like to put out an appeal for anyone who wants to go in with me on a venture to do the same thing with ARP.
    - dadrian 6y ago
      For $1000, I’ll let you ARP the EE prefix on my network
rhacker 6y ago
decentralized in the sense of not under the control of one organization.
forgotmypw17 6y ago
>It seems like tor .onion address would be an actually mature solution to this problem Already available: https://scihub22266oqcxt.onion https://scihub22266oqcxt.onion
- njarboe 6y ago
  I wonder why wikipedia mentions that it has an .onion address but does not show this address? People do keep the constantly changing URLs for it up-to-date and are even highlighted in the side bar, so a legal reason not to publish the link to it is unlikely the reason.
  - forgotmypw17 6y ago
    Probably edit wars.

troquerre 6y ago

The article has a few technical mistakes in it (I've found most publications do that when it comes to a technical subject I'm familiar with...), but in short Handshake is an alternative decentralized DNS root hosted on a blockchain. It aims to replace Certificate Authorities as the root of trust by pinning TLSA keys directly on the blockchain instead of relying on trusted parties for verfication.

jrochkind1 6y ago
So it aims to replace both DNS (a way of looking up IP address for a hostname) as well as certificate authorities (a way of knowing if the SSL cert being used by your connection is 'good')? Its an alternative DNS, with a method to use that alternative DNS as a way of authorizing ssl certs too?
- troquerre 6y ago
  That's right! Though the infrastructure for HTTPS without CAs on Handshake is still nascent (the community welcomes contributors if you're interested!). This article covers how to set up HTTPS on Handshake using DANE https://medium.com/@ca98am79/how-to-view-dane-tlsa-websites-on-handshake-with-firefox-f55eb1dd5be9 https://medium.com/@ca98am79/how-to-view-dane-tlsa-websites-...
koheripbal 6y ago
Which blockchain? It's own or will they use Bitcoin's blockchain?

buffrr 6y ago

I think what they meant is that with decentralized DNS, it is possible to replace certificate authorities by using DNSSEC + DANE RFC6698[0], but I agree the way it's mentioned is confusing. [0] https://tools.ietf.org/html/rfc6698 https://tools.ietf.org/html/rfc6698

jrochkind1 6y ago
ok. obviously you can replace cert authorities with those systems on present DNS too, it doesn't require a "(more) decentralized DNS", right? Replacing cert authorities with something DNS-based (or alternative decentralized DNS based) doesn't actually seem relevant to the problem they are highlighting, of sci-hub's DNS records being removed by private or government actors making it harder to find sci-hub... no?
- buffrr 6y ago
  To answer your first question, with the present DNS, If you use DANE, the trust is centralized since you have to trust the root DNS keys and the registrar (imo still better than trusting a large number of CAs. letsencrypt already relies on DNS to issue certificates).
KirillPanov 6y ago
> with decentralized DNS, it is possible to replace certificate authorities by using DNSSEC In what sense is DNSSEC decentralized? IMHO signing the root zone is about the most-centralizing thing that has ever happened to the Internet.
- tptacek 6y ago
  It is exactly that.
- tasuki 6y ago
  That's the thing Handshake is trying to address: with the root zone being on the (decentralized) blockchain, each TLD owner has full control over issuing the certificates for that domain using DNSSEC+DANE. The idea was that this would allow us to get rid of both the centralized root zone and CAs.

leephillips 6y ago

I agree. I found the article pretty incoherent, and gave up after a few paragraphs.

rasengan 6y ago

> But it sounds like handshake is simply an alternate DNS protocol? Handshake [1] is the next generation of DNS, as opposed to the ICANN controlled legacy system. It is more decentralized since a single actor does not control the system. You cannot be de-platformed without the consensus of the community and a fork, as opposed to a decision made by a single or small group of actors. > Or does it also serve as a certificate authority somehow? Since you can verify a certificate against a DANE TLSA record which is retrievable from a DNS zone with DS records stored on chain, the CA is no longer required for trust -- only cryptography. Checkout the paper which goes into far more detail [2]. The entire system actually incentivizes the Internet to become more secure -- which is pretty exciting! > Is it actually more decentralized than DNS It's more decentralized than DNS in that the root becomes the blockchain instead of ICANN. This project simply finishes the beautiful DNS ecosystem, which was already decentralized, other than the root. Now we are all root, democratically. [1] https://www.youtube.com/watch?v=Q3QbXMFjro0 https://www.youtube.com/watch?v=Q3QbXMFjro0 [2] https://handshake.org/files/handshake.txt https://handshake.org/files/handshake.txt

1vuio0pswjnm7 6y ago

This appears to be just another commercialisation of domain names, trying to create another "Gold Rush" for the most sought after "vanity" names. Winner-take-all. A few profit at the expense of the many. It perpetuates that problem of ICANN DNS becoming a "business" instead of solving it. (ICANN DNS domain names were originally free.) The potential for censorship is only one problem of ICANN DNS. Also, this project introduces a new problem of wasting energy on mining tokens.

rasengan 6y ago
> This appears to be just another commercialisation of domain names, trying to create another "Gold Rush" for the most sought after names. Winner-take-all. A few profit at the expense of the many. This is a major problem that the project has made a sincere attempt to address. Through scarcity certain sybil protections are afforded, which has been inherently architected into the consensus protocol [1]. Additionally, an airdrop to many internet pioneers and open source developers was built in as well, giving everyone similar resources to participate in the auction system which, in turn, affords everyone more equality in participation. Finally, the top 100k names as per alexa were pre-reserved for the holders in the alexa list, and these sites are incentivized to properly setup DNSSEC, as that's the only way they can claim their name on handshake. This is a win for internet security and internet users. It's absolutely a big win for freedom of speech. [1] https://handshake.org/files/handshake.txt https://handshake.org/files/handshake.txt
- tptacek 6y ago
  I feel obliged to point out again that this project appears to be a cryptocurrency scheme in which the owners are, in essence, selling the DNS naming hierarchy, which is genius since they do not in fact own it. Also, once again, I'd like to put out an appeal for anyone who wants to go in with me on a venture to do the same thing with ARP.
  - dadrian 6y ago
    For $1000, I’ll let you ARP the EE prefix on my network

rhacker 6y ago

decentralized in the sense of not under the control of one organization.

forgotmypw17 6y ago

>It seems like tor .onion address would be an actually mature solution to this problem Already available: https://scihub22266oqcxt.onion https://scihub22266oqcxt.onion

njarboe 6y ago
I wonder why wikipedia mentions that it has an .onion address but does not show this address? People do keep the constantly changing URLs for it up-to-date and are even highlighted in the side bar, so a legal reason not to publish the link to it is unlikely the reason.
- forgotmypw17 6y ago
  Probably edit wars.