8 ms·
> And you're missing the fact that CAs that misissue certificates can and will be distrusted by Chrome and Mozilla That doesn't protect against attacks from oc
by wizeman 4y ago
> And you're missing the fact that CAs that misissue certificates can and will be distrusted by Chrome and Mozilla
That doesn't protect against attacks from occurring, it only protects against future attacks from the same people who already attacked (assuming the same people don't create a new CA?).
And when Chrome and Mozilla distrusts a new CA, good luck on updating the certificate chains included in the operating systems of all the devices in the world, especially those that never update (old Android phones? IoT devices?).
> there's no way to revoke .COM
I think there is no need to revoke .COM because .COM can attack any domain within .COM anyway, even with/without DNSSEC and/or with/without CAs? Or what am I missing?
- growse 4y ago> > there's no way to revoke .COM > I think there is no need to revoke .COM because .COM can attack any domain within .COM anyway, even with/without DNSSEC and/or with/without CAs? Or what am I missing? The point is you don't build a system that assumes DNS is trustworthy, because it isn't.
- wizeman 4y ago> The point is you don't build a system that assumes DNS is trustworthy, because it isn't. But the current CA PKI system already assumes DNS is trustworthy, even much more than if you were using DNSSEC-protected DNS PKI system, since it is not only vulnerable to almost all the same attackers/attacks, but it is also vulnerable to many more attackers (since any CA can also do an attack at any time, regardless of any possible future consequences it may experience or not).
- tptacek 4y agoNo, it doesn't.