4 ms·
Convergence and DNSChain are two interesting proposals to replace the CA system. IMO, it's more important to emphasize the idea of secure origins, and HTTPS hi
by konklone 12y ago
Convergence and DNSChain are two interesting proposals to replace the CA system.
IMO, it's more important to emphasize the idea of secure origins, and HTTPS hits that note. TLS could be swapped out, the CA system could be changed, but what matters is the expectation that connections across the web are expected to be secure by default.
- tracker1 12y agoAgreed.. it's a shame that I can't just publish a public-key as part of a DNS entry for a domain, and as long as the DNS chain is secure (DNSSEC) then that key can be trusted.
- M2Ys4U 12y agoDNSSEC is just replacing one set of roots (the CAs) with another (the root servers). At least with CAs you can (theoretically) remove trust from a subset of them and things (mostly) keep working.