4 ms·
This is a feature! You can see from the domain name who you're trusting. Wouldn't it be great if TLS let you know in a similarly obvious manner when your CA is
by zurn 13y ago
This is a feature! You can see from the domain name who you're trusting. Wouldn't it be great if TLS let you know in a similarly obvious manner when your CA is the USG?
- tptacek 13y agoNo it's not! Your browser has a UI for changing which CAs you trust. Someone took actual time design buttons and dialogs for it. It's a crappy UI and nobody uses it, but it's clear that you do not need to trust the same set of CAs as everyone else to use the Internet. That is not at all true of DNSSEC. The DNSSEC roots are fixed. If you're not trusting the same roots as everyone else, you're not really even on the same Internet anymore.
- zurn 13y agoAs you well know, browsers come configured with an endless list of CAs that "the user trusts", including CAs from various nebulous governmental entities from all over the world. And they are all good for authenticating any .com domain. The UI you speak of is almost never invoked, unlike with the DNSSEC model where the address itself conveys information to the user in a form that even many non-technical users are accustomed to interpreting.
- tptacek 13y agoYou've totally missed the point. As I acknowledged in the comment you just replied to, nobody uses the crappy certificate UI in browsers. The fact that the UI exists means it is possible to change your certificate list. It is not possible to have users configure different DNS roots. DNS is part of Internet connectivity.