Re:Comcast Explains Why NASA's Web Site Was Blocked Last Wee...
by tptacek on Wednesday January 25, 2012 @01:42PM
(#3511049)
It's not that the DNSSEC model deprives my mom of the ability to make sensible decisions. It's that it deprives people like you of the opportunity to write programs to express sensible decisions that you are qualified to make.
We can fix the most glaring problem with HTTPS/TLS in userland code by building things like Moxie Marlinspike's Convergence scheme; instead of allowing browser vendors and huge companies like Verisign to entirely own the decision of whose certificates are to be trusted, instead allow interested parties to create and share their own trust policies.
This does not actually change any part of the HTTPS/TLS protocol. The CA certificate validation of TLS is out-of-band; it works based on decisions made by browser vendors.
In the post-Moxie world, my mom doesn't decide whether RapidSSL is a trustworthy verifier for MAIL.GOOGLE.COM; instead, her system is simply configured to rely on a trust community --- perhaps run by volunteers for EFF, or by Google, or someone else.
DNSSEC is brittle and does not allow for this level of expressiveness. Under DNSSEC, in 2010, Ghadafi controls all names under .LY, full stop. You can't implement "trust agility" to get around it: that static brittle trust model is baked into the core of the Internet.
We can fix the most glaring problem with HTTPS/TLS in userland code by building things like Moxie Marlinspike's Convergence scheme; instead of allowing browser vendors and huge companies like Verisign to entirely own the decision of whose certificates are to be trusted, instead allow interested parties to create and share their own trust policies.
This does not actually change any part of the HTTPS/TLS protocol. The CA certificate validation of TLS is out-of-band; it works based on decisions made by browser vendors.
In the post-Moxie world, my mom doesn't decide whether RapidSSL is a trustworthy verifier for MAIL.GOOGLE.COM; instead, her system is simply configured to rely on a trust community --- perhaps run by volunteers for EFF, or by Google, or someone else.
DNSSEC is brittle and does not allow for this level of expressiveness. Under DNSSEC, in 2010, Ghadafi controls all names under .LY, full stop. You can't implement "trust agility" to get around it: that static brittle trust model is baked into the core of the Internet.
That's a bad thing.