4 ms·

We need a truly decentralized alternative, DNSSEC isn't that.

• silisili 3y ago
  DNS is de facto decentralized. Stand up your own root, it's that simple. DNSSEC has no bearing on how centralized something is - it works the same on the current system as it would on your own new DNS system.
  • noman-land 3y ago
    Wait, what? How can I be my own certificate authority?
    • silisili 3y ago
      Openssl works just fine, if you're asking in earnest. Either way, it has no bearing on DNS.
    • cyberax 3y ago
      Create your own root certificate, import it into your browser, and into the OS certificate store. Then just sign CSRs with this root certificate's private key. This is pretty much what all large corporations do for their internal infrastructure.
      • RandomBK 3y ago
        This of course, only works for your own internal use. I feel this disclaimer needs to be called out explicitly. If you're trying to do something that will be trusted by the global internet, you'll need to use an official CA, ergo the complaints of DNSSEC being too 'centralized'.
        • IcePic 3y ago
          Then again, what the "global CAs" are doing is not wholly different in a technical level than what a company with their own internal CA does, except that I hope the global CAs take security very very seriously, and they pass an expensive audit. In the end, it is just some company or organisation that creates a root CA cert and intermediaries, and then jump through hoops to make browsers and OS cert stores add their certs. Not saying it is easy, just that the technical parts are rather similar, the rest being a cumbersome way to prove you are trustworthy by showing off your processes and fences around the signing boxes.
          • RandomBK 3y ago
            In the case of DNSSEC, the ultimate 'root key' is handled quite carefully and is interesting to read up on. https://www.iana.org/dnssec/files https://www.iana.org/dnssec/files https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/ https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/
        • detourdog 3y ago
          One can distribute self signed ssl certificates. Not using a CA is more secure for the group relying on the certificates to maintain encryption.
      • conradev 3y ago
        and, if you have a compelling reason, you can convince other CAs to cross-sign your certificate, like LetsEncrypt did: https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html https://letsencrypt.org/2020/09/17/new-root-and-intermediate... Browsers control what they trust, too, and can remove roots if they’re behaving poorly: https://blog.mozilla.org/security/2011/08/29/fraudulent-google-com-certificate/ https://blog.mozilla.org/security/2011/08/29/fraudulent-goog... That is to further your point: there is no central decision-maker
        • detourdog 3y ago
          Browser can also use self-signed certificates to trust lists.