3 ms·
Getting a cert requires someone to either compromise the primary DNS server for the domain, or to compromise DNS in multiple independent locations to serve cons
by mjg59 4y ago
Getting a cert requires someone to either compromise the primary DNS server for the domain, or to compromise DNS in multiple independent locations to serve consistent false answers to the probes. It's true that much of the TLS ecosystem is somewhat bound to DNS being trustworthy, but not to the same extent that SSHFP is.
- lozenge 4y agoThat also shows up on Certificate Transparency logs.
- dane-pgp 4y agoPeople used HTTPS before there were Certificate Transparency logs, so there's no reason why those couldn't be run for DNSSEC too. https://datatracker.ietf.org/doc/html/draft-zhang-trans-ct-dnssec-03 https://datatracker.ietf.org/doc/html/draft-zhang-trans-ct-d... https://www.huque.com/2014/07/30/dnssec-key-trans.html https://www.huque.com/2014/07/30/dnssec-key-trans.html https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-delegation-only-02 https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-deleg...
- jwilk 4y ago> or to compromise DNS in multiple independent locations to serve consistent false answers to the probes Do all CAs implement multi-prespective validation these days? Let's Encrypt implemented that only in 2020 and they believed they were the first ones: https://letsencrypt.org/2020/02/19/multi-perspective-validation.html https://letsencrypt.org/2020/02/19/multi-perspective-validat...