Re:Universal DNSSEC: Secure DNS for Every Domain
by throwaway2048 on Tuesday November 10, 2015 @02:04PM
(#10541524)
thats not the point OP was trying to make, the cert is issued via control of the domain, get control of the domain somehow, most any CA will happily issue you a cert for it.
[ Parent
| on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain
by snowwrestler on Tuesday November 10, 2015 @04:40PM
(#10542744)
Not all certs, though, right? I believe extended validation certs require more documentation than just domain control.
Re:Universal DNSSEC: Secure DNS for Every Domain
by tptacek on Tuesday November 10, 2015 @02:11PM
(#10541578)
Go try to get a domain-validated cert for Google. They are in no way relying on DNSSEC.
Re:Universal DNSSEC: Secure DNS for Every Domain
by xorcist on Tuesday November 10, 2015 @02:59PM
(#10542009)
I suppose that's easy bordering on trivial for an attacker of sufficient skill. At least it used to be. Is that no longer the case?
If there is a blacklist in place, absolutely each and every one of the hundreds of CAs need to adhere to it. One mistake or one exception and I could still get a misissued certificate just as easily as ten years ago.
Google can probably get it revoked very quickly, but we all know how well that works in practice. The only saving grace for the CA system is key pinning, and that's the only reason all those corrupt and/or incompentent CAs were exposed lately. But key pinning is not enough in itself. It is complementary to your certificate validation path(s).
Re:Universal DNSSEC: Secure DNS for Every Domain
by throwaway2048 on Tuesday November 10, 2015 @02:12PM
(#10541591)
That's great, if you are Google. I unfortunately, am not Google.