4 ms·
That would be less secure than if we just went with DANE + DNSSEC, which you could start using today without permission from anyone.
by xorcist 12y ago
That would be less secure than if we just went with DANE + DNSSEC, which you could start using today without permission from anyone.
- tptacek 12y agoAnd all we'd have to do is sign a giant chunk of the security of the Internet to the entities who run the top level domains, which should be fine, because no way would the DOJ ever manipulate the DNS to accomplish a policy goal.
- xorcist 12y agoIf the URI RFC mandated https://[fingerprint] https://[fingerprint], I'd agree with you. But the TLD is the entity we trust with the responsibility of delegating domains in the juridical sense anyway. If they say I own Google.com, I own it in every possible way, and I should be able to generate certificates for it. That's regardless of whether we use a CA model or a DNS-delegated one such as DANE. I would be perfectly fine with a model where we store certificates directly in WHOIS, but that would be slower and less practical that just using DNSSEC, which is already deployed.