Re:Heartbleed should bleed X.509 to death
by sparkie on Wednesday April 09, 2014 @06:42PM
(#7563005)
DNSsec is still broken by hierarchical trust - implied by some "authority", rather than chosen by the user.
I think the solution needs to be something like Moxie's Convergence, which allows for users to decide who they trust, and revoke such trust at any time.
https://www.youtube.com/watch?v=8N4sb-SEpcg
It's a shame that Convergence is basically dead, although there's still some activity in Perspectives on which it was based. (http://perspectives-project.org/)
Re:Heartbleed should bleed X.509 to death
by josteink on Wednesday April 09, 2014 @04:12PM
(#7562016)
If your DNS is compromised SSL and x509 is currently what's protecting your users from a fraudulent site.
> If your DNS is compromised SSL and x509 is currently what's protecting your users from a fraudulent site.
Uhm no? Because you can litterally just buy a new valid cert for it? As long as we're talking Domain Validated.
I doubt your average user will notice that there isn't a green bar anymore or that the certificate lacks ownership information.
Re:Heartbleed should bleed X.509 to death
by astrodust on Wednesday April 09, 2014 @04:56PM
(#7562323)
If DNSsec allows your domain's certificate to be signed vs. a more root authority (e.g. .com) then it would be a lot harder to introduce fraudulent DNS records.
> it should be possible to publish enough information to authenticate a given site against a certificate
You can, it's called DANE and is a future standard [0]. We're just waiting for DNSSEC to spread because without DNSSEC everything is unsecure.
DNS?
With the DNSsec extensions it should be possible to publish enough information to authenticate a given site against a certificate. If your DNS has been compromised you've got bigger problems than your SSL cert.