Re:New NSA Leak Shows MITM Attacks Against Major Internet Se...
by jlgaddis on Friday September 13, 2013 @11:35AM
(#6381126)
DANE[0] (in combination w/ DNSSEC[1]) is starting to sound really good right about now... except that, you know, the U.S. also runs several root nameservers.
[0]: https://tools.ietf.org/html/rfc6698 [1]: https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex...
Re:New NSA Leak Shows MITM Attacks Against Major Internet Se...
by dsl on Friday September 13, 2013 @11:39PM
(#6384561)
Root servers simply serve the content for the root zone, ICANN generates the contents of the root zone and signs it using an elaborate system of trust: http://dns.icann.org/ksk/
> We cannot have untrustworthy CAs in a system based on trust. That's simply not an option.
The entire CA trust model is broken. In the trust model, any CA can issue certs for any domain; so a Chinese CA could issue Google certs, or a US CA could issue certs for the Dutch government.
Self-signed certs with certificate pinning are indeed more likely to be secure than CA certs. Of course, you can do both; CA signed certs (which does add a small amount of trustworthiness, as the CA is at least supposed to do a little work to verify a real-world identity), and use certificate pinning to avoid this kind of attack.