3 ms·
I think the attack tptacek is suggesting is where a government replaces your key with their key, and your nameservers with their nameservers (perhaps with a pas
by wlonkly 3y ago
I think the attack tptacek is suggesting is where a government replaces your key with their key, and your nameservers with their nameservers (perhaps with a passthrough for non-interesting records), at which point they can send whichever responses they want with a valid signature.
In your example the Czech government would be the bad actor, but the US government could be the bad actor for .com.
- cyberax 3y agoThe thing is, I can pick and choose the government to host the website. If I don't like the Czech government's policies, I can use a domain in Turkey or Libya. The hierarchical nature of DNS makes it impossible for the US to covertly mess with that. This is strictly better than the current situation where de-facto any government can get a certificate for your domain name by putting pressure on one of the countless CAs. And quite a few governments even have their own CAs recognized by browsers.
- tptacek 3y agoThis is how you know the argument has lost the plot: your response to government manipulation of Internet cryptography is that Google can just leave .COM.