alt Hacker NewsMake dns secure and put certs / public keys in dns. Control over dns already gives you the right to get tls certs. It should just be connected directly. We don’t need CAs.
Replies
shiandow • today at 11:26 AM
Making DNS secure is not trivial though. In a way that's just moving the problem.
➕ show 2 replies
braiamp • today at 11:38 AM
That still requires trust stores to be distributed to the clients and some clients don't need that baggage on the dns. Also, dns is by default insecure, dnssec is a configuration nightmare
➕ show 1 reply
tptacek argues that DNSSEC is too flawed to actually do this:
https://sockpuppet.org/blog/2015/01/15/against-dnssec/