2 ms·
Fallacious argument. With WebPKI there are many roots that can MITM you. With DNSSEC there is only one. Once we have CT for DNSSEC it will be easier to watch
by cryptonector 5y ago
Fallacious argument.
With WebPKI there are many roots that can MITM you.
With DNSSEC there is only one.
Once we have CT for DNSSEC it will be easier to watch that root and the CA for each label in the domainname on the way to the QName than it is to watch tens of CAs in WebPKI.
- tptacek 5y agoDid you accidentally respond to the wrong thread? I do that all the time. The thread you're commenting on is one where the previous commenter suggested that you could mitigate DNSSEC's reliance on a government controlled PKI by substituting your own DNS roots.