On the technology front, Handshake is the only naming blockchain that's launching with a light client that can resolve names. This may seem like a small thing but it's actually a critical input to success — without a light client, users would either need to run fullnodes (which no one does bc of the terrible ux) or rely on third party services. Third party services provide good ux but reduce the benefit of using the decentralized system in the first place.
On the go-to-market front, the initial distribution of names is really important. It's much more important than the initial distribution of something like Bitcoin because names are non-fungible. They're digital real estate so if a whale is able to bid up all the good names before adoption, there will be no incentive for new participants to invest in the ecosystem (this happened to the previous projects).
Handshake created a few GTM mechanics to prevent that outcome:
* The Alexa top 100k domains have been pre-registered, so that only those domain owners can register their names on Handshake
* Names are released for bidding over a 52 week period. If you hear about Handshake 8 months into launch there will still be a lot of good names available
* Auctions last two weeks and require locking up your coins, making it difficult to bid and win on a lot of names at once.
* Most importantly imo, Handshake coins are being distributed to developers, not investors. 70% of the initial Handshake coins are being airdropped to ~250k open-source developers. Basically, if you have a GitHub account with over 15 followers and an SSH key, you can anonymously claim Handshake coins. This is a no-strings attached giveaway so it will hopefully give developers a reason to check out the project, and it also makes it difficult for whales to buy up a lot of coins early on to outbid everyone.
(Anyone else who’s interested can do this as well!)
The DigiNotar attack (from 2011) was mainly chosen because it's well known and easy to convey. It wasn't even that technically effectively because Chrome had Google's keys pinned, so it was immediately blocked and reported (like you would get with CT today). But, only in Chrome.
More recent examples of mississuance, like tricking Comodo's OCR-based validation [0] or spoofing DNS to hijack Let's Encrypt issuance [1].
CA's are always going to be vulnerable to these sorts of attacks, and they have such a broad attack surface and so much systemic trust (i.e power) that can cause unbounded damages with any error.
[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 [1] https://www.wired.com/2017/04/hackers-hijacked-banks-entire-...
Sure, but somebody else already did that so you can just rely on their work.
I'd expect someone trying at least discussing why that didn't make it. Also I'm really annoyed by the "there was a problem with CAs in 2011, this system is really bad"-tune ignoring what has been changed since then. (E.g. the "You don’t know who all these CA intermediates are" may be true, but that's your problem, because you very well could know, the information is there.)