3 ms·

Giving every CA the power to issue certificates for the whole web is insane. And depending on unauthenticated DNS to bootstrap the connection equally bonkers. S

by pedrocr 13y ago

Giving every CA the power to issue certificates for the whole web is insane. And depending on unauthenticated DNS to bootstrap the connection equally bonkers. Shouldn't we just use dnssec to have each domain publish it's own root certificate and be done with CA's for good? It would solve both issues and we wouldn't have to pay a third party just to be able to encrypt HTTP for our own domains.

mixedbit 13y ago
Having to pay a substantial fee for a certificate that assures you own a domain is insane. This technology needs to be improved. Encrypted and authenticated HTTP connection should be a default not a premium feature that site owners need to pay for. Why wild card certs are so much more expensive than single domain certs? From CA's infrastructure and verification point of view there shouldn't be any additional cost associated with issuing a wild card cert.
7952 13y ago
Doesn't dnssec still rely on a trust authority counter-signing? It may make it easier for browsers to be cautious but is hardly going to stop regimes like China. A better solution would be to tie all DNS records to a key on a hardware device that can be in the actual hands of the website operator (in a safe). What users want to know is that the website they visited yesterday is the one they visited today. Physical security of a single key that is never allowed to change is a better way to guarantee that than key chains.
- pedrocr 13y ago
  A quick read-through of the wikipedia page tells me it works as expected. The chain of trust follows the DNS hierarchy which is much saner than trusting all CAs for all domains. If you have yourdomain.com you're already trusting the .com TLD to not redirect your users somewhere else so you might as well also trust them for this. What you describe is basically a self-signed certificate which is known to be a poor solution. It easily allows someone to consistently MITM the whole web (think great firewall of china) without the users knowing.

by pedrocr 13y ago

mixedbit 13y ago

Having to pay a substantial fee for a certificate that assures you own a domain is insane. This technology needs to be improved. Encrypted and authenticated HTTP connection should be a default not a premium feature that site owners need to pay for. Why wild card certs are so much more expensive than single domain certs? From CA's infrastructure and verification point of view there shouldn't be any additional cost associated with issuing a wild card cert.

7952 13y ago

Doesn't dnssec still rely on a trust authority counter-signing? It may make it easier for browsers to be cautious but is hardly going to stop regimes like China. A better solution would be to tie all DNS records to a key on a hardware device that can be in the actual hands of the website operator (in a safe). What users want to know is that the website they visited yesterday is the one they visited today. Physical security of a single key that is never allowed to change is a better way to guarantee that than key chains.

pedrocr 13y ago
A quick read-through of the wikipedia page tells me it works as expected. The chain of trust follows the DNS hierarchy which is much saner than trusting all CAs for all domains. If you have yourdomain.com you're already trusting the .com TLD to not redirect your users somewhere else so you might as well also trust them for this. What you describe is basically a self-signed certificate which is known to be a poor solution. It easily allows someone to consistently MITM the whole web (think great firewall of china) without the users knowing.