4 ms·

> If your solution totally solves this problem technically, but is unlikely to be deployed in the real world, it is not a solution that totally solves this prob

> If your solution totally solves this problem technically, but is unlikely to be deployed in the real world, it is not a solution that totally solves this problem in my book. The solution is deployed in the real world for some websites right now, and it would take Google less effort to implement for their websites than the effort they're putting into CT. I suspect these comments are getting downvoted for reasons that have nothing to do with technical (or social) merit.

sanxiyn 12y ago
In my opinion, web browser extensions are not a viable way to deploy the solution to this problem. As far as I can tell, DNSChain has no buy in from web browser vendors. That makes it undeployable. It is irrelevant (or not very relevant) that it would take less effort than CT for Google. What is relevant is that Google is willing to implement CT, and not willing to implement DNSChain. Yes, this has nothing to do with technical merit, but it has a lot to do with actual merit of the solution in improving the current situation.
- itistoday2 12y ago
  > In my opinion, web browser extensions are not a viable way to deploy the solution to this problem. As far as I can tell, DNSChain has no buy in from web browser vendors. That makes it undeployable. One of the reasons why browser vendors are having a tough time actually fixing this problem is because CAs make a lot of money off of selling SSL certificates. We're working to remove obstacles out of their way by making it easier for them to support auth systems that do not rely on today's broken system. > What is relevant is that Google is willing to implement CT, and not willing to implement DNSChain. Yes, this has nothing to do with technical merit, but it has a lot to do with actual merit of the solution in improving the current situation. Google hasn't made up its mind on DNSChain-type solutions. Remember, CT wouldn't have prevented this attack. If they actually want to prevent such attacks, they have no choice but to actually fix the problem.
  - tptacek 12y ago
    It feels to me like the Chromium team has in fact made up its mind about blockchain solutions to the CA problem.
  - sanxiyn 12y ago
    I think http://queue.acm.org/detail.cfm?id=2668154 http://queue.acm.org/detail.cfm?id=2668154 is a pretty clear indication that Google will not implement blockchain-based solutions.

sanxiyn 12y ago

In my opinion, web browser extensions are not a viable way to deploy the solution to this problem. As far as I can tell, DNSChain has no buy in from web browser vendors. That makes it undeployable. It is irrelevant (or not very relevant) that it would take less effort than CT for Google. What is relevant is that Google is willing to implement CT, and not willing to implement DNSChain. Yes, this has nothing to do with technical merit, but it has a lot to do with actual merit of the solution in improving the current situation.

itistoday2 12y ago
> In my opinion, web browser extensions are not a viable way to deploy the solution to this problem. As far as I can tell, DNSChain has no buy in from web browser vendors. That makes it undeployable. One of the reasons why browser vendors are having a tough time actually fixing this problem is because CAs make a lot of money off of selling SSL certificates. We're working to remove obstacles out of their way by making it easier for them to support auth systems that do not rely on today's broken system. > What is relevant is that Google is willing to implement CT, and not willing to implement DNSChain. Yes, this has nothing to do with technical merit, but it has a lot to do with actual merit of the solution in improving the current situation. Google hasn't made up its mind on DNSChain-type solutions. Remember, CT wouldn't have prevented this attack. If they actually want to prevent such attacks, they have no choice but to actually fix the problem.
- tptacek 12y ago
  It feels to me like the Chromium team has in fact made up its mind about blockchain solutions to the CA problem.
- sanxiyn 12y ago
  I think http://queue.acm.org/detail.cfm?id=2668154 http://queue.acm.org/detail.cfm?id=2668154 is a pretty clear indication that Google will not implement blockchain-based solutions.