3 ms·

Very strange, because this feature was removed from Chrome just after DANE RFC was published and all work is done. It is evident that DANE will kill SSL certifi

by zhovner 13y ago

Very strange, because this feature was removed from Chrome just after DANE RFC was published and all work is done. It is evident that DANE will kill SSL certification business. The development suspension may result from pressure coming from CA's.

tptacek 13y ago
It will "kill" the certification business by vesting that authority with governments: the USG controls the root of .com, and Libya(!) controls .ly. If DANE had been successful a few years ago, Ghaddafi's government would have controlled bit.ly's certs.
- zurn 13y ago
  This is a feature! You can see from the domain name who you're trusting. Wouldn't it be great if TLS let you know in a similarly obvious manner when your CA is the USG?
  - tptacek 13y ago
    No it's not! Your browser has a UI for changing which CAs you trust. Someone took actual time design buttons and dialogs for it. It's a crappy UI and nobody uses it, but it's clear that you do not need to trust the same set of CAs as everyone else to use the Internet. That is not at all true of DNSSEC. The DNSSEC roots are fixed. If you're not trusting the same roots as everyone else, you're not really even on the same Internet anymore.
    - zurn 13y ago
      As you well know, browsers come configured with an endless list of CAs that "the user trusts", including CAs from various nebulous governmental entities from all over the world. And they are all good for authenticating any .com domain. The UI you speak of is almost never invoked, unlike with the DNSSEC model where the address itself conveys information to the user in a form that even many non-technical users are accustomed to interpreting.
      - tptacek 13y ago
        You've totally missed the point. As I acknowledged in the comment you just replied to, nobody uses the crappy certificate UI in browsers. The fact that the UI exists means it is possible to change your certificate list. It is not possible to have users configure different DNS roots. DNS is part of Internet connectivity.

by zhovner 13y ago

tptacek 13y ago

It will "kill" the certification business by vesting that authority with governments: the USG controls the root of .com, and Libya(!) controls .ly. If DANE had been successful a few years ago, Ghaddafi's government would have controlled bit.ly's certs.

zurn 13y ago
This is a feature! You can see from the domain name who you're trusting. Wouldn't it be great if TLS let you know in a similarly obvious manner when your CA is the USG?
- tptacek 13y ago
  No it's not! Your browser has a UI for changing which CAs you trust. Someone took actual time design buttons and dialogs for it. It's a crappy UI and nobody uses it, but it's clear that you do not need to trust the same set of CAs as everyone else to use the Internet. That is not at all true of DNSSEC. The DNSSEC roots are fixed. If you're not trusting the same roots as everyone else, you're not really even on the same Internet anymore.
  - zurn 13y ago
    As you well know, browsers come configured with an endless list of CAs that "the user trusts", including CAs from various nebulous governmental entities from all over the world. And they are all good for authenticating any .com domain. The UI you speak of is almost never invoked, unlike with the DNSSEC model where the address itself conveys information to the user in a form that even many non-technical users are accustomed to interpreting.
    - tptacek 13y ago
      You've totally missed the point. As I acknowledged in the comment you just replied to, nobody uses the crappy certificate UI in browsers. The fact that the UI exists means it is possible to change your certificate list. It is not possible to have users configure different DNS roots. DNS is part of Internet connectivity.