4 ms·
they can fetch the key or its hash from DNS. it's not like the current system is that much more involved. current system is basically a third party signed cache
by megous 19d ago
they can fetch the key or its hash from DNS. it's not like the current system is that much more involved. current system is basically a third party signed cache of such ownership claims validated based on ability of someone to modify DNS records.
All caches are just functionally useless layers..., so that's that.
- coldpie 19d agoHow do I know that the DNS record is owned by the entity they are claiming to be? CAs have nothing to do with caching.
- megous 19d agoYou don't know that even with DNS validated certificates. There's no separate "entity" claim other than "anybody with DNS record modification rights for a given domain". You can give out the same claim over DNS directly without any extra third party involvement in the form of CA.
- coldpie 19d agoHuh, wow. I kind of thought the whole point of CAs was to do identity verification. It they have dropped that entirely, what is the point?
- mirashii 19d agoDNS can be trivially MITM'd as well, it's certainly not a secure mechanism for distributing keys.
- megous 19d agoYou just taken down the whole business of dns validated CA issued certificates. Go claim your bounty. :)