4 ms·
Mostly because it rests on CA's and if the government can compel the CA to give them a signed cert for something that your security relies on, all they have to
by balabaster 13y ago
Mostly because it rests on CA's and if the government can compel the CA to give them a signed cert for something that your security relies on, all they have to do is pose a MITM attack and you're blissfully clueless that they're spying on you. The whole system is broken and if you don't fix the foundations upon which your house is built, no amount of band-aids are going to keep the walls standing.
- kyrias 13y agoNo, with DANE nothing rests on CA's. With DANE domain owners store their keys in the DNS, and the DNS records are signed with DNSSEC