Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It is a logical conclusion that I trust the set (my DNS registrar) at least as much as I trust the set (my DNS registrar ∩ All CAs in the world).

Not to mention that this would fix some of the incentive problems. DNS top-levels would effectively be competing on the strength of their certificate-issuing properties - if a particular TLD was known to have a more corruption-resistant registrar, then that TLD ought to become more sought-after by security-concious sites.



HTTPS doesn't depend on you trusting your DNS registrar!


There is a transitive trust relationship, because the a CA will typically supply a certificate to anyone who can prove that they control the domain, and the DNS registrar has ultimate control of the domain.


> a CA will typically supply a certificate to anyone who can prove that they control the domain

This is true, but it is also a problem that needs to be fixed. A CA should not only check whether you control the domain, but should also check your (real-world) identity, and in the case of a company, should also check other documents. Yes, most don't, or do it only ineffectually, but they should do it.


As always, trustworthy encryption boils down to identity assurance. Even in real-world personal interactions, identity assurance is subject to a leap of faith ("I believe this person is who they say they are based on the evidence they presented"). As such, is this problem even solvable? People rely on a much less stringent level of assurance to create secure connections on the Internet, because they want it handled within a single mouse click, and that expectation isn't going to change.

At least with a certificate issued by the registrar, there's some logical reason to believe that it was issued to whoever purchased the domain (whoever that is), which is often enough to establish an encrypted connection at a level the user expects. Significant problems remain, however: 1) Most domain owners have no idea how to generate a key and CSR (the registrar shouldn't do it) and 2) a truly reliable system for certificate revocation must exist to handle domain transfers. These aren't new problems, they just don't go away by shifting to this "easier" approach.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: