6 ms·
He's right the whole thing is a scam, but his solution is not correct. What needs to happen is the domain owner should be issued a wildcard cert for their domai
by __david__ 17y ago
He's right the whole thing is a scam, but his solution is not correct. What needs to happen is the domain owner should be issued a wildcard cert for their domain when they purchase the domain. The public key goes in the DNS and is itself signed by the registry (this prevents DNS spoofers from injecting valid certs).
So if I bought example.com I'd get a cert for * .example.com and its public key would sit in my dns somewhere signed by the master .com cert.
This would be more secure than what we have now and get rid of all the overpriced ssl resellers (really, you're charging me $100 a year for your thin wrapper around openssl?).
- oomkiller 17y agoOnce DNSSEC is implemented, this would probably be a lot more secure and easier to implement. EDIT: I think there is an RFC for this already: http://tools.ietf.org/html/rfc4398 http://tools.ietf.org/html/rfc4398
- tptacek 17y agoOr, you know, not: http://www.matasano.com/log/756/a-case-against-dnssec-count-1-solves-a-non-problem/ http://www.matasano.com/log/756/a-case-against-dnssec-count-... http://www.matasano.com/log/772/a-case-against-dnssec-count-2-too-complicated-to-deploy/ http://www.matasano.com/log/772/a-case-against-dnssec-count-...