3 ms·

We could, and should, switch to DANE. Or else, switch to how X.509 was supposed to be used, with each country running a CA for their nationals.

theamk 4mo ago
I trust governments much less that a conglomerate of competing corporations. With all the problems with Web PKI, at least the bad actors are getting distrusted, and this provides a very strong enforcement on the rest. And Certificate Transparency makes sure the mis-issuance would be caught. It is not perfect by any means, but things are getting better. With DANE (or other country-issued certificates), every government will absolutely double-issue certificates to police, secret service and friends of goverment, and no one will have any recourse. (In the past I'd say that only countries like Russia would do it.. but with today's climate, I am sure both US and many European countries will do that too)
- account42 4mo ago
  Pretty much any big government has a CA they can exert direct control over whenever needed.
  - theamk 4mo ago
    Maybe, but then can only do it once. Then they get caught, and their CA is distrusted. See Diginotar [0] for example. And things only gotten better since - we now have CT logs, and browsers require them, so any mis-issuance can be detected automatically, by any interested third party. If we go to DANE, we lose this all. "Oops, our CT uploader process failed, we will fix Real Soon(tm) we promise" - and what are browsers going to do? Distrust the entire country? [0] https://blog.mozilla.org/security/2011/09/02/diginotar-removal-follow-up/ https://blog.mozilla.org/security/2011/09/02/diginotar-remov...
    - deleted 4mo ago
      [deleted]
    - JumpCrisscross 4mo ago
      Side note: “DigiNotar BV was a Dutch certificate authority from 1998 to 2011. It was acquired in January 2011 by VASCO and subsequently declared bankrupt in September of the same year” [1]. I didn’t realize the slapped their face on the pavement right after being acquired. [1] https://en.wikipedia.org/wiki/DigiNotar https://en.wikipedia.org/wiki/DigiNotar
    - Fnoord 4mo ago
      The Dutch government didn't exercise control over Diginotar. In the Dutch hacker scene, Diginotar was a meme. Everyone knew it was a mess there.
- Parodper 4mo ago
  > every government will absolutely double-issue certificates to police, secret service and friends of goverment, and no one will have any recourse. Countries already have CA that issue certificates with more legal force than a handwritten signature. I can open a bank account, pay my taxes and sign up to all government services. But I can't use them for a webpage. > With DANE (or other country-issued certificates) DANE isn't a country-issued certificate. It's a scheme where you store your public keys on DNS records. Of course, now we have the issue that DNSSEC (signed DNS records) isn't widespread and the whole issue with DNS registries.
  - theamk 4mo ago
    DANE is entirely dependent on DNSSEC, and DNSSEC is, by design, under the government control, with all the bureaucratic mess and mistakes this implies. This would be pretty terrible if anyone actually cared about DNSSEC, but luckily for us, no one cares.. So let's keep things this way.
    - Parodper 4mo ago
      You obviously don't know how DNSSEC works. The DNS root of trust is ICANN, not a government.
      - trumpdong 4mo ago
        That's worse, because ICANN is effectively the US government.
        Parodper 4mo ago
        I'm the first to admit ICANN has issues, but US government control doesn't seem to be one of them.
    - trumpdong 4mo ago
      Domain registries can already get a certificate for your domain by changing the address to their own server temporarily and then doing ACME with LE. So no new vector is introduced by directly putting the cert in DNS.
- gopher_space 4mo ago
  > I trust governments much less that a conglomerate of competing corporations. There’s no essential difference between the two from my perspective. Why are these my only choices?
  - r-w 4mo ago
    One, in a democracy, is accountable to adults in the same jurisdiction. The other is only accountable to those with financial ties to its success.
    - coldtea 4mo ago
      >One, in a democracy, is accountable to adults in the same jurisdiction Or so they say. How's that been working out in practice?
      - Parodper 4mo ago
        Pretty well, in my experience.
        coldtea 4mo ago
        Yeah, that's why most countries in EU, as well as US, are in a huge dissarray, politicians have all time low approvals, people vote for something and get the opposite, and the economy and social climate turned to shit... I guess one doing well enough can be oblivious to all this...
        Parodper 4mo ago
        Try to read less tabloids.
        coldtea 4mo ago
        LOL, talk about out of touch. You need the press to tell you that? You can also just read "prestige press" - it will tell you the same. Or socio-economic indicators.
- toast0 4mo ago
  I'm not really in favor of DANE, because DNSSEC is such a mess ... but. Certificate transparency is nice. Browsers could require it for DANE certificates, just like they require it for current Web PKI certificates. The people controlling the TLD of interesting can exert control over the domain of interest in order to issue a DANE certificate. But they can also exert control over the domain of interest in order to request a domain control certificate, so widespread use of DANE wouldn't add any new adversaries. If DNSSEC wasn't a mess, and DANE replaced WebPKI, we would eliminate the risk from CAs without adding a new risk --- TLDs (and the DNS root) are existing risks.
  - trumpdong 4mo ago
    CT seems useless for DANE because the cert is self signed, so anyone can just flood the CT with self signed certs for your website. It's useful with WebPKI because only certs signed by a CA go in CT and it's a big deal if one is mis-issued. Anyone can mis-issue a self-signed cert at home for fun.
    - toast0 4mo ago
      You'd have to do something like pre-publish in DNS, submit to CT which verifies that it's in DNS before logging. And the CT could rate limit on domain name or something to reduce abuse.
  - Parodper 4mo ago
    And if they don't, DNS is already a database. You could just query domains to check their certificates. People running recursive DNS servers could double-check certificates.
    - toast0 4mo ago
      If the DNS takeover is limited in scope, the legitimate owner wouldn't be able to query it. CT addresses scoped attacks by making all webpki trusted certificates public knowledge. You would want something similar with DANE.
- xorcist 4mo ago
  > I trust governments much less that a conglomerate of competing corporations Let's not create a world wide PKI based on a political ideology. > country-issued certificates [...] every government will absolutely double-issue certificates This is such a strange argument. If you register a .ru domain, do you really think you are safe should the Russian intelligence services ask for a valid certificate? Controlling the actual domain, they could issue ask many domain validated certificates as they wish. The problem with our current SSL PKI, as so very many people have pointed out over the years, is that any CA is allowed to issue valid certificates for any domain name. There have been proposals to use X.509 extensions to remedy this, but they have seen lesser real world usage than the various certificate revocation schemes, which is very close to zero already. If there was no way for a Russian CA to issue certificates for .us domains, real world security would improve. A lot. And the other way around, of course. Feel free to s/Russian/Chinese/ in the above argument or whatever tickles your geopolitical fancies. The argument still stands. Domain registries decide who owns what domain. That is their literal role. You would think that asserting this ownership cryptographically would be a no-brainer in 2026. Yet we have this discussion over and over again. There are many people whose income quite literally depend on the status quo of our global SSL PKI, which coincidentally also offers no end of possibilities for the various intelligence services around the world. The next time someone tries to scare you with that governments or intelligence services control DNS and therefore it would be crazy to limit issuance of certificates to them, take a look where they have contracts.
  - toast0 4mo ago
    > The problem with our current SSL PKI, as so very many people have pointed out over the years, is that any CA is allowed to issue valid certificates for any domain name. There have been proposals to use X.509 extensions to remedy this, but they have seen lesser real world usage than the various certificate revocation schemes, which is very close to zero already. Some of the browser root programs include (or have included) restrictions on what tlds a CA is allowed to sign. I think for some of the iffier CAs that nonetheless had a huge marketshare in their country of origin. No need for the CA itself to include it in their root certificate. It would be handy if the name restrictions actually worked though. Then you could probably get a CA to sign an intermediate CA authorized only to issue certs for your domain(s). There are some CAs that will do that already where they provide an HSM with the intermediate CA's key that will only sign certs for authorized domains, but the CA cert does not encode the constraint and this is permitted by the ca/b agreement. It just seems like it'd be nicer if it just worked.
- dijit 4mo ago
  Companies have run some absolutely outstanding PR then. I have never worked in any company where I explicitly trust the CEO to always do the right thing in every situation. There is usually no governance board, or review system to inquire about public harm: those things are usually external and fought against as they are regulatory burden. So, in practice what tends to happen is that someone in the company just does stuff. Since humans aren't perfect this "doing stuff" is not always super enjoyable. If it's the CEO who "does stuff" then you're cooked because nobody except the board of directors can say anything meaningful: you gotta hope that the media wants to put pressure on. Our elected officials on the other hand, are supposed to represent us, and thus media pressure is a lot stronger; issues that affect many people are meant to be properly reflected, and their decisions are open by default.
  - theamk 4mo ago
    They key is multiple, competing companies. As long as they don't collude, if one company misbehaves, others will catch it.
    - dijit 4mo ago
      Hows that going for… … browsers … phones … operating systems … network appliances … payment transaction systems I feel like if it fails so often then it can’t be relied on.

theamk 4mo ago

I trust governments much less that a conglomerate of competing corporations. With all the problems with Web PKI, at least the bad actors are getting distrusted, and this provides a very strong enforcement on the rest. And Certificate Transparency makes sure the mis-issuance would be caught. It is not perfect by any means, but things are getting better. With DANE (or other country-issued certificates), every government will absolutely double-issue certificates to police, secret service and friends of goverment, and no one will have any recourse. (In the past I'd say that only countries like Russia would do it.. but with today's climate, I am sure both US and many European countries will do that too)

account42 4mo ago
Pretty much any big government has a CA they can exert direct control over whenever needed.
- theamk 4mo ago
  Maybe, but then can only do it once. Then they get caught, and their CA is distrusted. See Diginotar [0] for example. And things only gotten better since - we now have CT logs, and browsers require them, so any mis-issuance can be detected automatically, by any interested third party. If we go to DANE, we lose this all. "Oops, our CT uploader process failed, we will fix Real Soon(tm) we promise" - and what are browsers going to do? Distrust the entire country? [0] https://blog.mozilla.org/security/2011/09/02/diginotar-removal-follow-up/ https://blog.mozilla.org/security/2011/09/02/diginotar-remov...
  - deleted 4mo ago
    [deleted]
  - JumpCrisscross 4mo ago
    Side note: “DigiNotar BV was a Dutch certificate authority from 1998 to 2011. It was acquired in January 2011 by VASCO and subsequently declared bankrupt in September of the same year” [1]. I didn’t realize the slapped their face on the pavement right after being acquired. [1] https://en.wikipedia.org/wiki/DigiNotar https://en.wikipedia.org/wiki/DigiNotar
  - Fnoord 4mo ago
    The Dutch government didn't exercise control over Diginotar. In the Dutch hacker scene, Diginotar was a meme. Everyone knew it was a mess there.
Parodper 4mo ago
> every government will absolutely double-issue certificates to police, secret service and friends of goverment, and no one will have any recourse. Countries already have CA that issue certificates with more legal force than a handwritten signature. I can open a bank account, pay my taxes and sign up to all government services. But I can't use them for a webpage. > With DANE (or other country-issued certificates) DANE isn't a country-issued certificate. It's a scheme where you store your public keys on DNS records. Of course, now we have the issue that DNSSEC (signed DNS records) isn't widespread and the whole issue with DNS registries.
- theamk 4mo ago
  DANE is entirely dependent on DNSSEC, and DNSSEC is, by design, under the government control, with all the bureaucratic mess and mistakes this implies. This would be pretty terrible if anyone actually cared about DNSSEC, but luckily for us, no one cares.. So let's keep things this way.
  - Parodper 4mo ago
    You obviously don't know how DNSSEC works. The DNS root of trust is ICANN, not a government.
    - trumpdong 4mo ago
      That's worse, because ICANN is effectively the US government.
      - Parodper 4mo ago
        I'm the first to admit ICANN has issues, but US government control doesn't seem to be one of them.
  - trumpdong 4mo ago
    Domain registries can already get a certificate for your domain by changing the address to their own server temporarily and then doing ACME with LE. So no new vector is introduced by directly putting the cert in DNS.
gopher_space 4mo ago
> I trust governments much less that a conglomerate of competing corporations. There’s no essential difference between the two from my perspective. Why are these my only choices?
- r-w 4mo ago
  One, in a democracy, is accountable to adults in the same jurisdiction. The other is only accountable to those with financial ties to its success.
  - coldtea 4mo ago
    >One, in a democracy, is accountable to adults in the same jurisdiction Or so they say. How's that been working out in practice?
    - Parodper 4mo ago
      Pretty well, in my experience.
      - coldtea 4mo ago
        Yeah, that's why most countries in EU, as well as US, are in a huge dissarray, politicians have all time low approvals, people vote for something and get the opposite, and the economy and social climate turned to shit... I guess one doing well enough can be oblivious to all this...
        Parodper 4mo ago
        Try to read less tabloids.
        coldtea 4mo ago
        LOL, talk about out of touch. You need the press to tell you that? You can also just read "prestige press" - it will tell you the same. Or socio-economic indicators.
toast0 4mo ago
I'm not really in favor of DANE, because DNSSEC is such a mess ... but. Certificate transparency is nice. Browsers could require it for DANE certificates, just like they require it for current Web PKI certificates. The people controlling the TLD of interesting can exert control over the domain of interest in order to issue a DANE certificate. But they can also exert control over the domain of interest in order to request a domain control certificate, so widespread use of DANE wouldn't add any new adversaries. If DNSSEC wasn't a mess, and DANE replaced WebPKI, we would eliminate the risk from CAs without adding a new risk --- TLDs (and the DNS root) are existing risks.
- trumpdong 4mo ago
  CT seems useless for DANE because the cert is self signed, so anyone can just flood the CT with self signed certs for your website. It's useful with WebPKI because only certs signed by a CA go in CT and it's a big deal if one is mis-issued. Anyone can mis-issue a self-signed cert at home for fun.
  - toast0 4mo ago
    You'd have to do something like pre-publish in DNS, submit to CT which verifies that it's in DNS before logging. And the CT could rate limit on domain name or something to reduce abuse.
- Parodper 4mo ago
  And if they don't, DNS is already a database. You could just query domains to check their certificates. People running recursive DNS servers could double-check certificates.
  - toast0 4mo ago
    If the DNS takeover is limited in scope, the legitimate owner wouldn't be able to query it. CT addresses scoped attacks by making all webpki trusted certificates public knowledge. You would want something similar with DANE.
xorcist 4mo ago
> I trust governments much less that a conglomerate of competing corporations Let's not create a world wide PKI based on a political ideology. > country-issued certificates [...] every government will absolutely double-issue certificates This is such a strange argument. If you register a .ru domain, do you really think you are safe should the Russian intelligence services ask for a valid certificate? Controlling the actual domain, they could issue ask many domain validated certificates as they wish. The problem with our current SSL PKI, as so very many people have pointed out over the years, is that any CA is allowed to issue valid certificates for any domain name. There have been proposals to use X.509 extensions to remedy this, but they have seen lesser real world usage than the various certificate revocation schemes, which is very close to zero already. If there was no way for a Russian CA to issue certificates for .us domains, real world security would improve. A lot. And the other way around, of course. Feel free to s/Russian/Chinese/ in the above argument or whatever tickles your geopolitical fancies. The argument still stands. Domain registries decide who owns what domain. That is their literal role. You would think that asserting this ownership cryptographically would be a no-brainer in 2026. Yet we have this discussion over and over again. There are many people whose income quite literally depend on the status quo of our global SSL PKI, which coincidentally also offers no end of possibilities for the various intelligence services around the world. The next time someone tries to scare you with that governments or intelligence services control DNS and therefore it would be crazy to limit issuance of certificates to them, take a look where they have contracts.
- toast0 4mo ago
  > The problem with our current SSL PKI, as so very many people have pointed out over the years, is that any CA is allowed to issue valid certificates for any domain name. There have been proposals to use X.509 extensions to remedy this, but they have seen lesser real world usage than the various certificate revocation schemes, which is very close to zero already. Some of the browser root programs include (or have included) restrictions on what tlds a CA is allowed to sign. I think for some of the iffier CAs that nonetheless had a huge marketshare in their country of origin. No need for the CA itself to include it in their root certificate. It would be handy if the name restrictions actually worked though. Then you could probably get a CA to sign an intermediate CA authorized only to issue certs for your domain(s). There are some CAs that will do that already where they provide an HSM with the intermediate CA's key that will only sign certs for authorized domains, but the CA cert does not encode the constraint and this is permitted by the ca/b agreement. It just seems like it'd be nicer if it just worked.
dijit 4mo ago
Companies have run some absolutely outstanding PR then. I have never worked in any company where I explicitly trust the CEO to always do the right thing in every situation. There is usually no governance board, or review system to inquire about public harm: those things are usually external and fought against as they are regulatory burden. So, in practice what tends to happen is that someone in the company just does stuff. Since humans aren't perfect this "doing stuff" is not always super enjoyable. If it's the CEO who "does stuff" then you're cooked because nobody except the board of directors can say anything meaningful: you gotta hope that the media wants to put pressure on. Our elected officials on the other hand, are supposed to represent us, and thus media pressure is a lot stronger; issues that affect many people are meant to be properly reflected, and their decisions are open by default.
- theamk 4mo ago
  They key is multiple, competing companies. As long as they don't collude, if one company misbehaves, others will catch it.
  - dijit 4mo ago
    Hows that going for… … browsers … phones … operating systems … network appliances … payment transaction systems I feel like if it fails so often then it can’t be relied on.