3 ms·
> I'd say about point #9 is that DNSSEC is exactly a less broken CA system. I'd say DNSSEC is more broken than the current CA system. At least with the current
by rakoo 12y ago
> I'd say about point #9 is that DNSSEC is exactly a less broken CA system.
I'd say DNSSEC is more broken than the current CA system. At least with the current system you can more or less choose a CA to trust (or, more interestingly, a bunch of CAs), that you can change anytime you want. The only thing preventing you to do it is the lack of tools to actually do it, which is why tools such as TACK/HPKP, or Convergence/Perspectives, are needed.
With DNSSEC, there is only one realistic root ever possible (call it ICANN or NSA as you want, that's yet another problem)
- marcosdumay 12y ago> At least with the current system you can more or less choose a CA to trust Blind illusion. You must trust all of them. Any of them can attest somebody is you any time they want. The good thing about DNSSEC is exactly that it only has one root. And people can pin second and third level domains, completely escaping it - for some other org, controlled by some other agency, but one can choose what agency to submit their identity.