News for hackers. Stuff that matters.
Re:The DNSSEC master key securing DNS is about to change by _jomo on Monday August 29, 2016 @11:24AM (#12382461)
I wonder why moxie's Convergence [0] didn't take off. To me it sounds near-perfect. It could handle multiple layers of authenticity, including DNS.

The project has been inactive on GitHub for 5 years [1], however the Namecoin project picked it up [2] as "FreeSpeechMe" and added support for IPv6, and .bit, .onion, .b32.i2p domains. Now this, too, has been discontinued "because Mozilla removed the relevant API's as of Firefox 33". They "intend to release a replacement soon". According to Jeremy Rand [3] "A replacement is in the works (and is mostly working already)", but the source doesn't seem to be public or I can't find it.

Are there any downsides of Convergence?

0: https://www.youtube.com/watch?v=Z7Wl2FW2TcA

1: https://github.com/moxie0/Convergence/

2: https://github.com/namecoin/Convergence/

3: https://twitter.com/biolizard89/status/712525859194798080

Re:The DNSSEC master key securing DNS is about to change by StavrosK on Monday August 29, 2016 @11:44AM (#12382652)
IIRC, Google didn't want to run it because they'd end up running all the notaries themselves, which they didn't want to do.
Re:The DNSSEC master key securing DNS is about to change by _jomo on Monday August 29, 2016 @12:31PM (#12383044)
So according to this and CiPHPerCoder's comment, the only reason it didn't take off is that it didn't take off?

Edit: found the comment from Adam Langley [0]. They didn't want to add it to Chrome because it wouldn't meet standards for the preferences UI inclusion, practically everyone would just rely on the default notaries, so Google would have to guarantee notary uptime, thus being forced to run them on their own.

He doesn't really point out why they don't include it as an optional alternative without any notaries pre-configured. He does however say that running it as an extension would be fine, but the required APIs weren't available at the time of writing.

0: https://www.imperialviolet.org/2011/09/07/convergence.html

Re:The DNSSEC master key securing DNS is about to change by y0ghur7_xxx on Monday August 29, 2016 @02:55PM (#12384250)
I like it too. The cons just don't exist in my pow:

one downside was that it didn't work on things like airport access points, but those break regular tls too.

an other downside was the fact that google didn't want to integrate it in chrome because the notaries would have to be always up. now they run transparency logs that have to be always up anyway. so.. what's the difference?

The Perspectives Project piked up the idea, and it seems less dead that Convergence: https://perspectives-project.org/

Re:The DNSSEC master key securing DNS is about to change by tptacek on Monday August 29, 2016 @12:41PM (#12383116)
To me, HPKP, surveillance, and God willing a better UX for certificates would get us 80% of the way to Convergence.
Re:The DNSSEC master key securing DNS is about to change by internals on Monday August 29, 2016 @02:12PM (#12383871)
One big challenge was it didn't account for gated hotspots (hotels, Starbucks, etc) where you need to authenticate to reach the Internet.
Re:The DNSSEC master key securing DNS is about to change by CiPHPerCoder on Monday August 29, 2016 @11:26AM (#12382491)
> Are there any downsides of Convergence?

Your web browser grinds to a halt because almost no one runs a notary. I tried using it for a while.