3 ms·

The root of the problem is inability to pin pubkey directly to a DNS record which is changeable only by the owner of the private key. If there was a single plac

The root of the problem is inability to pin pubkey directly to a DNS record which is changeable only by the owner of the private key. If there was a single place where any client can check which PK owns which name and trust derived SSL certificates from there, then the end user UI would be simpler and safer altogether. Suggestion: a protocol to register names on Bitcoin blockchain. You can securely transfer ownership of a name, securely associate more metadata with it etc. Every client can independently check if a given certificate for a given domain name is issued by a proper owner, not by one of opaque organizations that you just have to trust. Today personal computers are bundled with hundreds of root certificates. If one is compromised by FBI or Mossad, they can impersonate FB or Google no problem. DNS records can be taken from you and/or censored, DNS servers spoofed etc. Combining SSL with decentralized DNS-on-blockchain is just so logical. BTW, Namecoin is not the best attempt because it requires separate blockchain. People want one, the most powerful, most robust blockchain and we should pin all our metadata right there. The real problem is how to organize socially, how to agree that this particular protocol with that distribution of names is The Name System, while all others are cheap clones.

oleganza 13y ago
Just to clarify: With modern DNS and SSL one of the root issuers can be compromised to impersonate any website. More root certificates - more targets. With blockchain as a root authority, every website is their own guardian. If Google loses their keys, someone may impersonate only Google, but not Facebook, Twitter or your homepage. In combination with multisignature transactions, Google may lock access to their "BitDNS" records to a board of directors with 3-of-5 vote. If one or two keys are compromised or unavailable, it does not stop the company from moving their property how they want.
JetSpiegel 13y ago
Namecoin is the best attempt, because if someone compromises DNS it doesn't immediately have access to real money. The task of maintaining Namecoin would be taken by the current maintainers of the DNS system. What's so bad about keeping different things separated?
- oleganza 13y ago
  Any bitcoin-like blockchain must be a valuable currency at the core to reward miners with minted units and fees. Otherwise, there's no incentive to deploy petahashes of computing power to secure consensus worldwide. Namecoin is a currency. If it's not valuable, its security is nil. Economically, users want to keep cash in the most liquid (marketable) asset, therefore, users and miners want to converge on a single most powerful blockchain (aka "network effect"). Today it's Bitcoin and it can only change if it's completely replaced for some reason by a superior, even more liquid blockchain. Also: blockchain does not need to store more than 32 bytes of metadata or have special name-handling features like Namecoin does. You only need to associate 1 satoshi with a 32-byte hash of your metadata (addresses, certificates, private keys etc.) Metadata can be distributed by any means, e.g. by today's network of name servers. Blockchain only works as a proof of name ownership that links that metadata to a name. You can use just 1 satoshi to be allocated for the name. If you lose your name, it'll be worth much more than that anyway.
  - michaelt 13y ago
    You only need to associate 1 satoshi with a 32-byte hash of your metadata (addresses, certificates, private keys etc.) Metadata can be distributed by any means, e.g. by today's network of name servers. If you store the hashes and rely on something else to tell you the metadata, how do you stop people deleting records from the past by deleting or blocking access to the metadata? For example: The legitimate owner of www.alice.com creates a DNS record saying "www.alice.com is owned by alice", then puts scrypt("www.alice.com is owned by alice") into the blockchain, then creates a DNS record saying "and the proof of this ownership is transaction e8a2e79eee906 which took place in December 2013". You're on malicious coffee shop wifi. You don't have anything pinned. You make a DNS request and you get records saying "www.alice.com is owned by eve" and "the proof of this is transaction c8bb5f503dc26820 which took place in January 2014". How do you find the first, legitimate transaction?
  - JetSpiegel 13y ago
    Of course there's incentive to secure consensus! If you don't secure it, you lose your domain name. It's like a registrar, only distributed and (maybe) safer.

oleganza 13y ago

Just to clarify: With modern DNS and SSL one of the root issuers can be compromised to impersonate any website. More root certificates - more targets. With blockchain as a root authority, every website is their own guardian. If Google loses their keys, someone may impersonate only Google, but not Facebook, Twitter or your homepage. In combination with multisignature transactions, Google may lock access to their "BitDNS" records to a board of directors with 3-of-5 vote. If one or two keys are compromised or unavailable, it does not stop the company from moving their property how they want.

JetSpiegel 13y ago

Namecoin is the best attempt, because if someone compromises DNS it doesn't immediately have access to real money. The task of maintaining Namecoin would be taken by the current maintainers of the DNS system. What's so bad about keeping different things separated?

oleganza 13y ago
Any bitcoin-like blockchain must be a valuable currency at the core to reward miners with minted units and fees. Otherwise, there's no incentive to deploy petahashes of computing power to secure consensus worldwide. Namecoin is a currency. If it's not valuable, its security is nil. Economically, users want to keep cash in the most liquid (marketable) asset, therefore, users and miners want to converge on a single most powerful blockchain (aka "network effect"). Today it's Bitcoin and it can only change if it's completely replaced for some reason by a superior, even more liquid blockchain. Also: blockchain does not need to store more than 32 bytes of metadata or have special name-handling features like Namecoin does. You only need to associate 1 satoshi with a 32-byte hash of your metadata (addresses, certificates, private keys etc.) Metadata can be distributed by any means, e.g. by today's network of name servers. Blockchain only works as a proof of name ownership that links that metadata to a name. You can use just 1 satoshi to be allocated for the name. If you lose your name, it'll be worth much more than that anyway.
- michaelt 13y ago
  You only need to associate 1 satoshi with a 32-byte hash of your metadata (addresses, certificates, private keys etc.) Metadata can be distributed by any means, e.g. by today's network of name servers. If you store the hashes and rely on something else to tell you the metadata, how do you stop people deleting records from the past by deleting or blocking access to the metadata? For example: The legitimate owner of www.alice.com creates a DNS record saying "www.alice.com is owned by alice", then puts scrypt("www.alice.com is owned by alice") into the blockchain, then creates a DNS record saying "and the proof of this ownership is transaction e8a2e79eee906 which took place in December 2013". You're on malicious coffee shop wifi. You don't have anything pinned. You make a DNS request and you get records saying "www.alice.com is owned by eve" and "the proof of this is transaction c8bb5f503dc26820 which took place in January 2014". How do you find the first, legitimate transaction?
- JetSpiegel 13y ago
  Of course there's incentive to secure consensus! If you don't secure it, you lose your domain name. It's like a registrar, only distributed and (maybe) safer.