4 ms·
> How is a registrar holding your keys in any aspect better than WebPKI right now? In this context, the question is more "how is a registrar holding your keys
by naniwaduni 4y ago
> How is a registrar holding your keys in any aspect better than WebPKI right now?
In this context, the question is more "how is a registrar holding your keys in any aspect worse?" There are a couple of mostly availability-related risk models where having DNSSEC at all is probably nets negative but your registrar generally has de facto control over your domain under the no-DNSSEC PKI anyway. There is a wide range of viable use-cases where telling your registrar that yeah turn on DNSSEC is nearly free and gets you ... well, the extremely minor benefit of being able to use DNS as a verifiable public kvmap.
- Avamander 4y ago> In this context, the question is more "how is a registrar holding your keys in any aspect worse?" I find it fairly obvious that such an extra operator in the middle of the trust chain between your webserver and your end-user is worse. > but your registrar generally has de facto control over your domain under the no-DNSSEC PKI anyway. Yes-ish. The issue is that DANE+DNSSEC would give the registrars control over the keys, which door they belong to and nobody could determine otherwise. A registrar trying to do the same right now with WebPKI would most likely be pathetically caught in the act, either by trying to redirect traffic without a valid certificate or trying to issue a certificate and it getting logged.