News for hackers. Stuff that matters.

A comment on Heartbleed should bleed X.509 to death. Parent comment

Re:Heartbleed should bleed X.509 to death by josteink on Wednesday April 09, 2014 @04:12PM (#7562016)
If your DNS is compromised SSL and x509 is currently what's protecting your users from a fraudulent site.
[ Parent | on HN ]
Re:Heartbleed should bleed X.509 to death by lawl on Wednesday April 09, 2014 @04:27PM (#7562109)
> If your DNS is compromised SSL and x509 is currently what's protecting your users from a fraudulent site.

Uhm no? Because you can litterally just buy a new valid cert for it? As long as we're talking Domain Validated.

I doubt your average user will notice that there isn't a green bar anymore or that the certificate lacks ownership information.

[ Parent | on HN ]
Re:Heartbleed should bleed X.509 to death by astrodust on Wednesday April 09, 2014 @04:56PM (#7562323)
If DNSsec allows your domain's certificate to be signed vs. a more root authority (e.g. .com) then it would be a lot harder to introduce fraudulent DNS records.
[ Parent | on HN ]