LWN: Comments on "Convergence: User-controlled SSL certificate checking"

Convergence: User-controlled SSL certificate checking

michi — Sat, 29 Oct 2011 14:37:24 +0000

Hi!

I agree with you that shifting the trust to DNS providers will not really solve much. But my point was actually: If the dnssec cannot be trusted, why should perspectives be trusted?

However, I still think DNSSEC is good. First it can be implemented additional to CAs, so there are 2 layers of security. Second, only the dns provider can compromise a specific site and not a huge number of unrelated organisations.

The approach I like best is using .onion like addresses with the crypto key encoded in the url.

Convergence: User-controlled SSL certificate checking

sblack — Fri, 28 Oct 2011 18:29:25 +0000

Marlinspike addresses DNSSEC at the end of his talk and on his blog [1]. The short version is, you're just moving the trust around. There is, if anything, less reason to trust GoDaddy.com to keep their servers secure than there is to trust VeriSign.

[1] http://blog.thoughtcrime.org/

Convergence: User-controlled SSL certificate checking

michi — Fri, 28 Oct 2011 09:21:18 +0000

It sounds like an interesting idea. But I do not really see why it should be more secure that dnssec. You cannot spoof dnssec unless you have access to the dns server the domain is hosted on. If you do have access, you can change the ip address and all perspectives will connect to you instead. Actually dnssec is probably more secure, because it also protects you from doing man-in-the-middle in right front of the server.