3 ms·
Doesn't dnssec still rely on a trust authority counter-signing? It may make it easier for browsers to be cautious but is hardly going to stop regimes like Chin
by 7952 13y ago
Doesn't dnssec still rely on a trust authority counter-signing? It may make it easier for browsers to be cautious but is hardly going to stop regimes like China.
A better solution would be to tie all DNS records to a key on a hardware device that can be in the actual hands of the website operator (in a safe). What users want to know is that the website they visited yesterday is the one they visited today. Physical security of a single key that is never allowed to change is a better way to guarantee that than key chains.
- pedrocr 13y agoA quick read-through of the wikipedia page tells me it works as expected. The chain of trust follows the DNS hierarchy which is much saner than trusting all CAs for all domains. If you have yourdomain.com you're already trusting the .com TLD to not redirect your users somewhere else so you might as well also trust them for this. What you describe is basically a self-signed certificate which is known to be a poor solution. It easily allows someone to consistently MITM the whole web (think great firewall of china) without the users knowing.