7 ms·

http://www.certificate-transparency.org/how-ct-works http://www.certificate-transparency.org/how-ct-works

by agl 12y ago

bdamm 12y ago
If only there was a blockchain for this.
- jdfellow 12y ago
  Don't know about this Certificate Transparency thing but Namecoin does allow a certificate fingerprint to be associated with a domain, without using a CA, and it works rather well.
  - ryan-c 12y ago
    That does work for domains within Namecoin, but it cannot be used for ICANN TLDs. People have suggested pairing schemes to allow domains under other TLDs to be associated with Namecoin records but I have yet to see one that is secure (they all rely on honest miners).
- schoen 12y ago
  There's a growing literature and conversation about the tradeoffs between blockchains and the approach that CT takes. They are actually historically related to one another. http://www.aaronsw.com/weblog/squarezooko http://www.aaronsw.com/weblog/squarezooko Ben Laurie (a co-inventor of CT) had some particular objections to blockchains, partly to do with the problem that the total computational power that is or will be brought to bear on mining is unknown and maybe unknowable. http://www.links.org/files/decentralised-currencies.pdf http://www.links.org/files/decentralised-currencies.pdf http://www.links.org/files/distributed-currency.pdf http://www.links.org/files/distributed-currency.pdf I'd like to actually make a web page that talks about the historical relationship between blockchains and other decentralized append-only data stores, as well as the points of debate and trade-offs between different designs, and the space of proposals that achieve consensus about the contents of an append-only record.
  - mike_hearn 12y ago
    The CT approach is a lot more efficient assuming a closed network of pre-registered "miners" (logs, in CT parlance). This works ok for CT because CT does not place such a large emphasis on decentralisation, nor does it need to. Ultimately the power in the SSL system lies with browser and OS vendors, in turn that means only a handful of people really. Having a super fancy ultra-decentralised system that will only be used by a handful of OS services and browsers doesn't make a whole lot of sense.
- higherpurpose 12y ago
  You mean like this? https://github.com/okTurtles/dnschain https://github.com/okTurtles/dnschain
  - ryan-c 12y ago
    okTurtles is one of several middleware options that runs on top of Namecoin, implementing the domain record spec. It advocates using someone else's trusted server as a data source, but does not at this time implement any integrity protection for data in transit. http://www.freespeechme.org/ http://www.freespeechme.org/ is a more mature and more secure. Edit: DNSChain does not appear to provide certificate validation for .bit domains in common browsers at this time. It can serve DANE records, but the browsers don't currently verify them and the existing browser extensions for adding DANE support require DNSSEC which DNSChain does not provide, unless I'm missing something.
    - higherpurpose 12y ago
      I think DNSchain offers some compatibility with .bit domains, but the real innovation happens with .dns domains?
    - itistoday2 12y ago
      FreeSpeechMe is not practical for use because it requires running Namecoin locally. DNSChain is just as secure as FreeSpeechMe when connected to a trusted DNSChain server. > It advocates using someone else's trusted server This is misleading. You and Jeremy keep repeating this line and it honestly feels like a vendetta at this point (I hope it's not). It advocates connecting to your DNSChain server (or a close friend's). This is security that is either on par with FreeSpeechMe (without the baggage), or orders of magnitude better than what's provided by HTTPS today.
itistoday2 12y ago
Certificate Transparency does not work. It does not, as it claims, always provide a log of issued certificates and it does not stop MITM attacks: - http://www.ietf.org/mail-archive/web/trans/current/msg00233.html http://www.ietf.org/mail-archive/web/trans/current/msg00233.... - http://okturtles.com/#oktvs http://okturtles.com/#oktvs It also does nothing to fix the non-functioning certificate revocation problem (which is not a problem with the blockchain).

http://www.certificate-transparency.org/how-ct-works http://www.certificate-transparency.org/how-ct-works

by agl 12y ago

http://www.certificate-transparency.org/how-ct-works http://www.certificate-transparency.org/how-ct-works

bdamm 12y ago

If only there was a blockchain for this.

jdfellow 12y ago
Don't know about this Certificate Transparency thing but Namecoin does allow a certificate fingerprint to be associated with a domain, without using a CA, and it works rather well.
- ryan-c 12y ago
  That does work for domains within Namecoin, but it cannot be used for ICANN TLDs. People have suggested pairing schemes to allow domains under other TLDs to be associated with Namecoin records but I have yet to see one that is secure (they all rely on honest miners).
schoen 12y ago
There's a growing literature and conversation about the tradeoffs between blockchains and the approach that CT takes. They are actually historically related to one another. http://www.aaronsw.com/weblog/squarezooko http://www.aaronsw.com/weblog/squarezooko Ben Laurie (a co-inventor of CT) had some particular objections to blockchains, partly to do with the problem that the total computational power that is or will be brought to bear on mining is unknown and maybe unknowable. http://www.links.org/files/decentralised-currencies.pdf http://www.links.org/files/decentralised-currencies.pdf http://www.links.org/files/distributed-currency.pdf http://www.links.org/files/distributed-currency.pdf I'd like to actually make a web page that talks about the historical relationship between blockchains and other decentralized append-only data stores, as well as the points of debate and trade-offs between different designs, and the space of proposals that achieve consensus about the contents of an append-only record.
- mike_hearn 12y ago
  The CT approach is a lot more efficient assuming a closed network of pre-registered "miners" (logs, in CT parlance). This works ok for CT because CT does not place such a large emphasis on decentralisation, nor does it need to. Ultimately the power in the SSL system lies with browser and OS vendors, in turn that means only a handful of people really. Having a super fancy ultra-decentralised system that will only be used by a handful of OS services and browsers doesn't make a whole lot of sense.
higherpurpose 12y ago
You mean like this? https://github.com/okTurtles/dnschain https://github.com/okTurtles/dnschain
- ryan-c 12y ago
  okTurtles is one of several middleware options that runs on top of Namecoin, implementing the domain record spec. It advocates using someone else's trusted server as a data source, but does not at this time implement any integrity protection for data in transit. http://www.freespeechme.org/ http://www.freespeechme.org/ is a more mature and more secure. Edit: DNSChain does not appear to provide certificate validation for .bit domains in common browsers at this time. It can serve DANE records, but the browsers don't currently verify them and the existing browser extensions for adding DANE support require DNSSEC which DNSChain does not provide, unless I'm missing something.
  - higherpurpose 12y ago
    I think DNSchain offers some compatibility with .bit domains, but the real innovation happens with .dns domains?
  - itistoday2 12y ago
    FreeSpeechMe is not practical for use because it requires running Namecoin locally. DNSChain is just as secure as FreeSpeechMe when connected to a trusted DNSChain server. > It advocates using someone else's trusted server This is misleading. You and Jeremy keep repeating this line and it honestly feels like a vendetta at this point (I hope it's not). It advocates connecting to your DNSChain server (or a close friend's). This is security that is either on par with FreeSpeechMe (without the baggage), or orders of magnitude better than what's provided by HTTPS today.

itistoday2 12y ago

Certificate Transparency does not work. It does not, as it claims, always provide a log of issued certificates and it does not stop MITM attacks: - http://www.ietf.org/mail-archive/web/trans/current/msg00233.html http://www.ietf.org/mail-archive/web/trans/current/msg00233.... - http://okturtles.com/#oktvs http://okturtles.com/#oktvs It also does nothing to fix the non-functioning certificate revocation problem (which is not a problem with the blockchain).