9 ms·

It used to be possible to get HTTPS on Chrome, without warning, without getting certificates from CA, by using DNSSEC. Nobody used it so it was removed. https:

by sanxiyn 13y ago

It used to be possible to get HTTPS on Chrome, without warning, without getting certificates from CA, by using DNSSEC. Nobody used it so it was removed. https://www.imperialviolet.org/2011/06/16/dnssecchrome.html https://www.imperialviolet.org/2011/06/16/dnssecchrome.html

ktt 13y ago
Wow, I didn't know about it! That's a shame it was removed - I couldn't find a site to test it or the issue in Chromium tracker about removing it though. More information: https://code.google.com/p/chromium/issues/detail?id=50874 https://code.google.com/p/chromium/issues/detail?id=50874 And in Mozilla Wiki: https://wiki.mozilla.org/Security/DNSSEC-TLS-details https://wiki.mozilla.org/Security/DNSSEC-TLS-details
zhovner 13y ago
Very strange, because this feature was removed from Chrome just after DANE RFC was published and all work is done. It is evident that DANE will kill SSL certification business. The development suspension may result from pressure coming from CA's.
- tptacek 13y ago
  It will "kill" the certification business by vesting that authority with governments: the USG controls the root of .com, and Libya(!) controls .ly. If DANE had been successful a few years ago, Ghaddafi's government would have controlled bit.ly's certs.
  - zurn 13y ago
    This is a feature! You can see from the domain name who you're trusting. Wouldn't it be great if TLS let you know in a similarly obvious manner when your CA is the USG?
    - tptacek 13y ago
      No it's not! Your browser has a UI for changing which CAs you trust. Someone took actual time design buttons and dialogs for it. It's a crappy UI and nobody uses it, but it's clear that you do not need to trust the same set of CAs as everyone else to use the Internet. That is not at all true of DNSSEC. The DNSSEC roots are fixed. If you're not trusting the same roots as everyone else, you're not really even on the same Internet anymore.
      - zurn 13y ago
        As you well know, browsers come configured with an endless list of CAs that "the user trusts", including CAs from various nebulous governmental entities from all over the world. And they are all good for authenticating any .com domain. The UI you speak of is almost never invoked, unlike with the DNSSEC model where the address itself conveys information to the user in a form that even many non-technical users are accustomed to interpreting.
        tptacek 13y ago
        You've totally missed the point. As I acknowledged in the comment you just replied to, nobody uses the crappy certificate UI in browsers. The fact that the UI exists means it is possible to change your certificate list. It is not possible to have users configure different DNS roots. DNS is part of Internet connectivity.

by sanxiyn 13y ago

ktt 13y ago

Wow, I didn't know about it! That's a shame it was removed - I couldn't find a site to test it or the issue in Chromium tracker about removing it though. More information: https://code.google.com/p/chromium/issues/detail?id=50874 https://code.google.com/p/chromium/issues/detail?id=50874 And in Mozilla Wiki: https://wiki.mozilla.org/Security/DNSSEC-TLS-details https://wiki.mozilla.org/Security/DNSSEC-TLS-details

zhovner 13y ago

Very strange, because this feature was removed from Chrome just after DANE RFC was published and all work is done. It is evident that DANE will kill SSL certification business. The development suspension may result from pressure coming from CA's.

tptacek 13y ago
It will "kill" the certification business by vesting that authority with governments: the USG controls the root of .com, and Libya(!) controls .ly. If DANE had been successful a few years ago, Ghaddafi's government would have controlled bit.ly's certs.
- zurn 13y ago
  This is a feature! You can see from the domain name who you're trusting. Wouldn't it be great if TLS let you know in a similarly obvious manner when your CA is the USG?
  - tptacek 13y ago
    No it's not! Your browser has a UI for changing which CAs you trust. Someone took actual time design buttons and dialogs for it. It's a crappy UI and nobody uses it, but it's clear that you do not need to trust the same set of CAs as everyone else to use the Internet. That is not at all true of DNSSEC. The DNSSEC roots are fixed. If you're not trusting the same roots as everyone else, you're not really even on the same Internet anymore.
    - zurn 13y ago
      As you well know, browsers come configured with an endless list of CAs that "the user trusts", including CAs from various nebulous governmental entities from all over the world. And they are all good for authenticating any .com domain. The UI you speak of is almost never invoked, unlike with the DNSSEC model where the address itself conveys information to the user in a form that even many non-technical users are accustomed to interpreting.
      - tptacek 13y ago
        You've totally missed the point. As I acknowledged in the comment you just replied to, nobody uses the crappy certificate UI in browsers. The fact that the UI exists means it is possible to change your certificate list. It is not possible to have users configure different DNS roots. DNS is part of Internet connectivity.