3 ms·
Virtually none of the most important sites on the Internet are signed. When's the last time one was maliciously misissued?
by tptacek 5mo ago
Virtually none of the most important sites on the Internet are signed. When's the last time one was maliciously misissued?
- moquilabs 5mo agoFair point. I'm just looking for a way to cryptographically prove that my website is from me in a way that browsers will accept. This means the whole chain from ICANN -> Verisign -> registrar -> dns -> IP -> my server.
- tptacek 5mo ago1. Browsers briefly tried adopting DANE and gave up on it. 2. DNS is the wrong level of networking abstraction to do this kind of policy enforcement at, because DNS isn't plumbed for warnings and error reporting; when DNSSEC fails, whole zones simply fall of the Internet (for people who validate) as if they weren't there at all. It's the worst possible failure mode. 3. The thing you say you want can't be had with DNSSEC. You don't get "the whole chain from ICANN to your server". Any of the parent zone operators above you can decide to defect, for your zone specifically, and (particularly for state-level adversaries) for particular targets resolving your zones, without you ever knowing about it.
- inigyou 5mo agoIf any of the parent zones defects, they can trivially misissue a certificate. Having separate CAs that ddo whatever DNS says doesn't improve anything.