3 ms·

If TXT-records are proof enough when ownership is to be provided for TLS certs. Then, why not just put the TLS-data into the "trusted" TXT-records and skip the

If TXT-records are proof enough when ownership is to be provided for TLS certs. Then, why not just put the TLS-data into the "trusted" TXT-records and skip the multi-billion-dollar-BS-CA-biz all together?

donselaar 3y ago
Makes sense indeed. It exists and it's called DANE. https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
- hashstring 3y ago
  Yes and then your government controls your “trusted” connection.
  - AtNightWeCode 3y ago
    Like NSA did not controlled CA:s? Or are you one of those conspiracy nuts that think NSA cracked it?
    - hashstring 3y ago
      The way that we deal with CAs now developed so much after these issues were disclosed. It is actually adding to my argument. The NSA and any other government entities REALLY WANT to control these certificates. However, our interaction with CAs became much more secure now because we learned and developed things like CT logs. Major browsers are removing entire CAs from their trust store if shady stuff happens ASAP. You can’t do the same with TLDs. This argument is made frequently on here, why would you even want to propose to regress into stuff like DANE…? DNS servers are such a bad trust anchor, if you could even call it a trust anchor at all. If you want to discuss further, I ask you to stay on topic instead of name calling.
thewataccount 3y ago
I'm not sure I 100% understand your question. If you're asking "Why do we need CA's when they already control the DNS record for that domain" then the answer is that DNS doesn't natively even have any cryptography involved, your DNS server can serve any information it wants, and this is common practice in IT environments. Effectively speaking MITM'ing dns is relatively easy and common as it's the equivalent to HTTP. So you don't know that the answer you are receiving it actually from the owner of that domain. If they sent you a certificate you don't know if that's an attackers certificate or the owner's certificate. The CA system is a (very imperfect) method of verifying ownership by having a trusted third party do the ownership verification. This way the certificate the owner gives you is effectively "notarized" so to speak. tl;dr - DNS has no built-in signing or encryption, and is "MiTM'd" by design. It's common practice for your DNS server to be set to your company's DNS server, your ISP, etc. And those can send any response they want, and you have no way to authenticate if it's been modified or not.
8organicbits 3y ago
First, Let's Encrypt exists and is free. Second, DNS-01 uses multiperspective validation, which is fairly complex. https://letsencrypt.org/2020/02/19/multi-perspective-validation.html https://letsencrypt.org/2020/02/19/multi-perspective-validat...

donselaar 3y ago

Makes sense indeed. It exists and it's called DANE. https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

hashstring 3y ago
Yes and then your government controls your “trusted” connection.
- AtNightWeCode 3y ago
  Like NSA did not controlled CA:s? Or are you one of those conspiracy nuts that think NSA cracked it?
  - hashstring 3y ago
    The way that we deal with CAs now developed so much after these issues were disclosed. It is actually adding to my argument. The NSA and any other government entities REALLY WANT to control these certificates. However, our interaction with CAs became much more secure now because we learned and developed things like CT logs. Major browsers are removing entire CAs from their trust store if shady stuff happens ASAP. You can’t do the same with TLDs. This argument is made frequently on here, why would you even want to propose to regress into stuff like DANE…? DNS servers are such a bad trust anchor, if you could even call it a trust anchor at all. If you want to discuss further, I ask you to stay on topic instead of name calling.

thewataccount 3y ago

I'm not sure I 100% understand your question. If you're asking "Why do we need CA's when they already control the DNS record for that domain" then the answer is that DNS doesn't natively even have any cryptography involved, your DNS server can serve any information it wants, and this is common practice in IT environments. Effectively speaking MITM'ing dns is relatively easy and common as it's the equivalent to HTTP. So you don't know that the answer you are receiving it actually from the owner of that domain. If they sent you a certificate you don't know if that's an attackers certificate or the owner's certificate. The CA system is a (very imperfect) method of verifying ownership by having a trusted third party do the ownership verification. This way the certificate the owner gives you is effectively "notarized" so to speak. tl;dr - DNS has no built-in signing or encryption, and is "MiTM'd" by design. It's common practice for your DNS server to be set to your company's DNS server, your ISP, etc. And those can send any response they want, and you have no way to authenticate if it's been modified or not.

8organicbits 3y ago

First, Let's Encrypt exists and is free. Second, DNS-01 uses multiperspective validation, which is fairly complex. https://letsencrypt.org/2020/02/19/multi-perspective-validation.html https://letsencrypt.org/2020/02/19/multi-perspective-validat...