3 ms·

All of the problems you listed around trusting TLDs applies to Let's Encrypt/ACME DNS-01 validation though...

• bawolff 4y ago
  I mean, with dns validation you at least have records that someone did the attack bia cert transparency, with dane the attack is harder to detect.
• deleted 4y ago
  [deleted]
• acdha 4y ago
  There's one useful exception: say that the Libyan government decided to override bit.ly's DNSSEC records — if all you use is DANE, they've won and they can do that seamlessly for a subset of clients without anyone else noticing. If they try the same thing attacking a DNS-validated certificate system, they lose the covert aspect because Certificate Transparency forces the malicious certificate to be logged in an immutable record. There are services which monitor those logs to alert owners and it makes it easier for researchers to piece together what happened retroactively, as we saw recently with the TrustCor affair where CT logs were useful for determining what certificates that CA had been issuing.
• tptacek 4y ago
  No, they don't. Browsers can dis-trust LetsEncrypt; inclusion in the Mozilla and Google root programs is at their discretion.