News for hackers. Stuff that matters.

A comment on Show HN: Fast and simple way to get EV SSL certificates.

Re:Show HN: Fast and simple way to get EV SSL certificates by shawabawa3 on Monday March 16, 2015 @10:14AM (#9211505)
SSL Certs are the biggest racket on the internet.

Can anyone tell me why certs can't work in the same way as DKIM, where you include the certificate fingerprint in a DNS text record? Is DNS not secure enough? and if not why is it good enough for email?

[ Parent | on HN ]
Re:Show HN: Fast and simple way to get EV SSL certificates by detaro on Monday March 16, 2015 @10:25AM (#9211570)
DNS is not secured in any way (by default, DNSSEC is not that widely deployed yet and also not without flaws), therefore putting the fingerprint in DNS does nothing for protection against man-in-the-middle attacks.

DKIM is vulnerable against that, but the impact of doing so is lower (breaking anti-spam vs being able to intercept HTTPS)

[ Parent | on HN ]