logoalt Hacker News

JackSlateur • today at 5:54 PM • 1 reply • view on HN

The registry operator for .com has all the privileges (regarding certificate generation) over all .com domains

As such, DANE would not add more issue here;

DNSSEC is easy to deploy (of course, you need to know your work, which is rarely the case). Legacy-first mindset is not really productive;

That's is correct, but on the other hand, incorrect: as a .com registry, I can:

  - fake the CAA records
  - fake the DCV records
  - make any CA sign any certificates
People would not even notice because, if a given website is commonly signed by LE, I can trick LE into signing a new certificate for me. The transparency logs would just show that LE signed a certificate, as usual. Again: registries have already all the power in the world (it is a good thing: not the current issue :) )

Replies

tptacek • today at 5:55 PM

DNSSEC is so easy to deploy that Cloudflare had to disable it entirely for a significant chunk of all Internet traffic because... the registry operators of .DE were unable to deploy it safely.

This is more than twenty-five years after DNSSEC standardization commenced in earnest (counting from the bis protocol).

➕ show 1 reply