Re:Cookies Lack Integrity: Real-World Implications
by MichaelGG on Friday September 25, 2015 @04:11PM
(#10280417)
DNSSEC means creating irrevocable CAs that'd be under essentially-direct control of major governments. No thanks. At least with the current system, if a CA fails to act proper, they can get smacked back. With DNSSEC, if .com starts issuing *.com certs, there's no recourse.
[ Parent
| on HN ]
Re:Cookies Lack Integrity: Real-World Implications
by pas on Saturday September 26, 2015 @01:30PM
(#10283706)
Huh? Your site can be already completely hijacked by the same actors. Your browser trusts a lot of CAs so VeriSign (or whoever operates the .com zone) can already issue .com certs. And your only hope is to preload your cert (which is a Chrome only thing, and pretty inefficient and inflexible).
The Convergence Project with notaries is an even better solution.
But using the DNS as the authoritative source of data and using external parties to keep an eye on that would both lead to efficiency (performance, flexibility) and security (as in from the State).