4 ms·
This central authority for certificate validation seems like extra infrastructure without which the internet fails. Once upon a time, internet communication wa
by nashashmi 2y ago
This central authority for certificate validation seems like extra infrastructure without which the internet fails.
Once upon a time, internet communication was between two computers. Now there is a third computer to verify that the communication between two computers is legitimate.
Is there another communication design that works without the need for a third computer?
Edit: I don't think so. Identity validation of a public computer should be done by another well-trusted computer.
- devman0 2y agoCould dust off DANE here, the connection probably already included a DNS lookup, why not get the public key info from the same.
- tptacek 2y agoSo many reasons, but the simplest is that those lookups will constantly fail because middleboxes makes variegated inane decisions about 53/udp and 53/tcp, which means you need to have a fallback mechanism, which will inevitably be exploitable. DANE is a dead letter.
- nine_k 2y agoBetween two distrusting parties, a third mediating party is needed. But that party does not need to be centralized. Indeed, there are many TLS certificate registrars.