| > The point is that you can't kill a TLD operator. I agree, you can't kill a TLD operator. But WebPKI relies on TLD operators to establish identity, so I don't see what we gain from WebPKI, other than mandatory CT logs, and not having to faff about with DNSSEC :P ... both of those are pretty valuable, of course. I'll put it another way: why do we want a CA to tell us that someone controls a domain, when the TLD could tell us? The TLD is authoritative with regard to who controls a domain; CAs can only report on what they have observed. |
| |
| ▲ | tptacek an hour ago | parent [-] | | Today's incident isn't a domain binding issue; it's a key mishandling issue. Elevating the role of TLD operators here just increases the number of organizations we have to trust to handle keys properly; worse, as we agree, those new keyholders can't have their authority revoked. In the main, attacks on the DV process aren't protocol attacks; they're simple ATO attacks on registrars. The DV part of the WebPKI is certainly gross and could be improved, but evidence from the last 20 years says pretty clearly that the DV process itself is not the most urgent risk in the system. My first hope is that we continue to ratchet security requirements for CAs upwards, and in doing so wash more and more incompetent operators out. | | |
| ▲ | quotemstr 21 minutes ago | parent [-] | | My objection is your choosing to build mechanisms that force us to make sure your "we" can "continue to ratchet security" instead of building mechanics that distribute trust and enforce it technology. I don't care if you write 100,000 or 1,000,000 words: there's nothing wrong with DNSSEC or security that rides on it in principle except that it distributes trust decisions that have been centralized in those objecting to DNSSEC. It is very bad for the internet to depend for its security on a tiny number of individuals to make global judgements about who's a bad actor. | | |
| ▲ | tptacek 7 minutes ago | parent [-] | | Your counterproposal is simply to expand the number of individuals who get to make those global judgements! | | |
| ▲ | quotemstr 2 minutes ago | parent [-] | | How so? In the current regime, I can obtain a certificate automatically via ACME. if I control the domain, so to retain control over myexample.com, I need to trust the DNS infrastructure up to my TLD and trust every CA, including the "my secret key is return 4" crowd In a DANE world, I need only trust the DNS authorities, and there are ways to boost trust in, e.g. the dot-com key management. (Could even go full ring signatures if we wanted.) Someone over on foo.wtf.lol can't hurt me. |
|
|
|
|
