News for hackers. Stuff that matters.

A comment on DNSSEC KSK Rollover Postponed. Parent comment

Re:DNSSEC KSK Rollover Postponed by TorKlingberg on Friday September 29, 2017 @06:26AM (#15364087)
Forgive an uninformed comment, but isn't DNSSEC the only viable route away from globally trusted CAs? And the CA model is just fundamentally wrong in many ways (still better than nothing or trust on first use though).
[ Parent | on HN ]
Re:DNSSEC KSK Rollover Postponed by pornel on Friday September 29, 2017 @06:59AM (#15364227)
DNSSEC has a CA-like trust model.

It's only a route to the same thing, but with weaker crypto, no Certificate Transparency, and no ability to distrust bad actors (distrusting Symantec's Verisign CA is feasible, but dropping Verisign's `.com` is not).

[ Parent | on HN ]
Re:DNSSEC KSK Rollover Postponed by andrius4669 on Friday September 29, 2017 @10:36AM (#15365630)
>DNSSEC has a CA-like trust model.

Not really.

You cannot get .tk operator to sign .jp domain (unless they're both controlled by same authority, which usually isn't the case).

[ Parent | on HN ]
Re:DNSSEC KSK Rollover Postponed by tptacek on Friday September 29, 2017 @10:58AM (#15365855)
Who cares? The majority of commercially important domain names live under parts of the DNS hierarchy that are de jure controlled by the Five Eyes governments.
[ Parent | on HN ]
Re:DNSSEC KSK Rollover Postponed by marcosdumay on Friday September 29, 2017 @12:50PM (#15366895)
The TLS CA has some functionality specified for non-global trust. It is just that nobody implements it.
[ Parent | on HN ]