| ▲ | shiandow 6 hours ago |
| Making DNS secure is not trivial though. In a way that's just moving the problem. |
|
| ▲ | josephg 4 hours ago | parent | next [-] |
| A secure DNS is valuable whether or not we get rid of CAs, since CAs rely on DNS queries to verify domain ownership. And if we have a secure DNS, then CAs are completely redundant. I'd much rather trust a handful of domain registrars than a handful of domain registrars, plus 100 random questionably competent organisations all over the world. Especially when any one of them can generate keys for every domain on the planet. |
| |
| ▲ | darkwater 4 hours ago | parent [-] | | It seems a nice thing to have indeed, but domain registrars have already a history to cede control and bend to $GOVERNMENT. We have countries already trying to MiTM all their citizens by mandating CAs injection in every device under their jurisdiction, what would be the defense against this threat in a world where registrars hold the keys to TLS encryption for the web on the TLDs they own as root?
I'm not that expert in this field so I really would like to learn if it's possible. | | |
| ▲ | shiandow 2 hours ago | parent [-] | | Not that it isn't an interesting question but what's preventing them now? You can get a certificate for any domain you control. It is just really obvious if you abuse that power. Which shouldn't really change with DNSSEC I think. |
|
|
|
| ▲ | vesinisa 6 hours ago | parent | prev [-] |
| Isn't this what DNSSEC solves? |
| |
| ▲ | muvlon 5 hours ago | parent | next [-] | | DNSSEC deployment has been anything but trivial. This APNIC post from 2024 estimated that about 1% of DNS queries were being validated via DNSSEC: https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/. That's more than 25 years after the IETF first standardized DNSSEC. | | | |
| ▲ | shiandow 5 hours ago | parent | prev [-] | | It should, though it achieves that goal by a chain of certificates not unlike CAs just tied to DNS. Like I said, it essentially just moves the problem. Which might still be better, if only because it limits the surface area. |
|
