4 ms·
(I assume you meant to s/Verizon/Verisign/ there.) Are you saying that if I don't trust [current .com delegate] to manage my naming authentication, I can choos
by dvanduzer 11y ago
(I assume you meant to s/Verizon/Verisign/ there.)
Are you saying that if I don't trust [current .com delegate] to manage my naming authentication, I can choose .ly or .io instead? I was trying to point out that DNSSEC can't do anything about googIe.com or similar i18n-style attacks.
I'm glad that TACK exists, and I'm glad people like tptacek are advocating for it. But DNSSEC and X.509 aren't the only two possibilities for the future of secure infrastructure.
- marcosdumay 11y agoFunny thing that TACK and the Google project for certificate transparency have exactly the same failure point of DNSSEC, in that both will make all the names public. TACK is great. Google's certificate transparency isn't. And, yes, we need more proposals. The more, the better. And, by the way, yes, it's Verisign, thanks.