3 ms·

Is there really that significant of a difference between clear text and just accepting an arbitrary TLS cert without trusting a CA? I can understand criticizing

Is there really that significant of a difference between clear text and just accepting an arbitrary TLS cert without trusting a CA? I can understand criticizing the modern TLS/CA system if you're concerned about security, but how does clear text avoid the failings of "bad CAs" here? It's not like encrypting with a cert signed by a corrupt CA gives any entity the ability to do bad things, no more than would be possible over clear text, at least.

superkuh 4y ago
In this context, as DNS over HTTPS, you're right. There's not much difference except that the provider has to only allow uses of it's DNS service that won't upset the CA TLS cert provider. And the user of DNS lookups has have a very modern computer (software-wise) to support the ever changing root certs; so using old, stable, software (and retro-computing) is further restricted. But it is much different in other contexts like HTTPS (HTTP/2 + HTTP/3) only browsers where now human people are unable to host a visitable website without getting a continued approval from a CA.