News for hackers. Stuff that matters.

A comment on Opportunistic Security for HTTP. Parent comment

Re:Opportunistic Security for HTTP by tptacek on Monday November 03, 2014 @08:11AM (#8550595)
And all we'd have to do is sign a giant chunk of the security of the Internet to the entities who run the top level domains, which should be fine, because no way would the DOJ ever manipulate the DNS to accomplish a policy goal.
[ Parent | on HN ]
Re:Opportunistic Security for HTTP by xorcist on Tuesday November 04, 2014 @02:34AM (#8555475)
If the URI RFC mandated https://[fingerprint], I'd agree with you. But the TLD is the entity we trust with the responsibility of delegating domains in the juridical sense anyway.

If they say I own Google.com, I own it in every possible way, and I should be able to generate certificates for it. That's regardless of whether we use a CA model or a DNS-delegated one such as DANE.

I would be perfectly fine with a model where we store certificates directly in WHOIS, but that would be slower and less practical that just using DNSSEC, which is already deployed.

[ Parent | on HN ]