5 ms·

Can't this be solved with some kind of distributed, authenticated, pre-existing protocol? Something like... DNS? With the DNSsec extensions it should be possi

Can't this be solved with some kind of distributed, authenticated, pre-existing protocol? Something like... DNS? With the DNSsec extensions it should be possible to publish enough information to authenticate a given site against a certificate. If your DNS has been compromised you've got bigger problems than your SSL cert.

wmf 13y ago
http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Nam...
josteink 13y ago
If your DNS is compromised SSL and x509 is currently what's protecting your users from a fraudulent site.
- lawl 13y ago
  > If your DNS is compromised SSL and x509 is currently what's protecting your users from a fraudulent site. Uhm no? Because you can litterally just buy a new valid cert for it? As long as we're talking Domain Validated. I doubt your average user will notice that there isn't a green bar anymore or that the certificate lacks ownership information.
- astrodust 13y ago
  If DNSsec allows your domain's certificate to be signed vs. a more root authority (e.g. .com) then it would be a lot harder to introduce fraudulent DNS records.
sparkie 13y ago
DNSsec is still broken by hierarchical trust - implied by some "authority", rather than chosen by the user. I think the solution needs to be something like Moxie's Convergence, which allows for users to decide who they trust, and revoke such trust at any time. https://www.youtube.com/watch?v=8N4sb-SEpcg https://www.youtube.com/watch?v=8N4sb-SEpcg It's a shame that Convergence is basically dead, although there's still some activity in Perspectives on which it was based. (http://perspectives-project.org/ http://perspectives-project.org/)
rakoo 13y ago
> it should be possible to publish enough information to authenticate a given site against a certificate You can, it's called DANE and is a future standard [0]. We're just waiting for DNSSEC to spread because without DNSSEC everything is unsecure. [0] https://tools.ietf.org/html/rfc6698 https://tools.ietf.org/html/rfc6698

wmf 13y ago

http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Nam...

josteink 13y ago

If your DNS is compromised SSL and x509 is currently what's protecting your users from a fraudulent site.

lawl 13y ago
> If your DNS is compromised SSL and x509 is currently what's protecting your users from a fraudulent site. Uhm no? Because you can litterally just buy a new valid cert for it? As long as we're talking Domain Validated. I doubt your average user will notice that there isn't a green bar anymore or that the certificate lacks ownership information.
astrodust 13y ago
If DNSsec allows your domain's certificate to be signed vs. a more root authority (e.g. .com) then it would be a lot harder to introduce fraudulent DNS records.

sparkie 13y ago

DNSsec is still broken by hierarchical trust - implied by some "authority", rather than chosen by the user. I think the solution needs to be something like Moxie's Convergence, which allows for users to decide who they trust, and revoke such trust at any time. https://www.youtube.com/watch?v=8N4sb-SEpcg https://www.youtube.com/watch?v=8N4sb-SEpcg It's a shame that Convergence is basically dead, although there's still some activity in Perspectives on which it was based. (http://perspectives-project.org/ http://perspectives-project.org/)

rakoo 13y ago

> it should be possible to publish enough information to authenticate a given site against a certificate You can, it's called DANE and is a future standard [0]. We're just waiting for DNSSEC to spread because without DNSSEC everything is unsecure. [0] https://tools.ietf.org/html/rfc6698 https://tools.ietf.org/html/rfc6698