News for hackers. Stuff that matters.

A comment on DNSSEC KSK Rollover Postponed. Parent comment

Re:DNSSEC KSK Rollover Postponed by pornel on Friday September 29, 2017 @06:59AM (#15364227)
DNSSEC has a CA-like trust model.

It's only a route to the same thing, but with weaker crypto, no Certificate Transparency, and no ability to distrust bad actors (distrusting Symantec's Verisign CA is feasible, but dropping Verisign's `.com` is not).

[ Parent | on HN ]
Re:DNSSEC KSK Rollover Postponed by andrius4669 on Friday September 29, 2017 @10:36AM (#15365630)
>DNSSEC has a CA-like trust model.

Not really.

You cannot get .tk operator to sign .jp domain (unless they're both controlled by same authority, which usually isn't the case).

[ Parent | on HN ]
Re:DNSSEC KSK Rollover Postponed by tptacek on Friday September 29, 2017 @10:58AM (#15365855)
Who cares? The majority of commercially important domain names live under parts of the DNS hierarchy that are de jure controlled by the Five Eyes governments.
[ Parent | on HN ]