News for hackers. Stuff that matters.

A comment on Handshake – Decentralized naming and certificate authority. Parent comment

Re:Handshake – Decentralized naming and certificate authority by dotancohen on Monday July 25, 2022 @06:23AM (#32222570)
How would that work? Add another DNS record? It would have to be out of band as the server cannot be trusted (see HPKP), and DNS itself could just as easily be MITMed as an HTTPS request, often even moreso.
[ Parent | on HN ]
Re:Handshake – Decentralized naming and certificate authority by aaomidi on Monday July 25, 2022 @08:06AM (#32223217)
That’s what CAA records are for, and the enforcement is happening before it gets to the end user by the various root programs.
[ Parent | on HN ]
Re:Handshake – Decentralized naming and certificate authority by lizardactivist on Monday July 25, 2022 @08:53AM (#32223608)
Ultimately I suppose it would have to involve some pre-shared key. It could be made tolerable with a browser addon holding entries for critical websites. But maybe the mentioned CAA has already solved this.
[ Parent | on HN ]