4 ms·
In both cases what it boils down to is that "it's an alternative to the current CA system". Sure, alternatives are good, but why does it need to be coupled to D
by peanut-walrus 3y ago
In both cases what it boils down to is that "it's an alternative to the current CA system". Sure, alternatives are good, but why does it need to be coupled to DNS? If I have a .ly domain, do I really want to be forced to trust the Libyan government for my security?
- deleted 3y ago[deleted]
- teddyh 3y agoWhat do think a ccTLD is, if not a TLD controlled by a country, meaning the government of that country? In what world would it be reasonable for you to have a .ly domain and not trust the Libyan government not to do whatever they like to your domain? Like, you know, everybody already does with every .com and the U.S. government?
- peanut-walrus 3y agoBut that is exactly the point: in the world we are in right now, I DON'T have to trust the TLD operator to make sure my services are secure. Sure, there is a risk that the TLD operator will shut down my domain completely, but that is a different risk from the TLD operator MitM-ing my services. If my CA misbehaves? I can use a different CA. Not trivial, but doable. What if my TLD operator misbehaves or TLD changes ownership (like the .org case a few years ago) - change my domain?
- teddyh 3y ago> What if my TLD operator misbehaves or TLD changes ownership (like the .org case a few years ago) - change my domain? That already happens all the time. And when it does happen, the new owner can get a legitimate certificate for it.
- NavinF 3y agoUnder today's CA system the gov't can't MiTM without getting noticed on the certificate transparency logs. There's no equivalent for DNSSEC.