Hacker News Reader

Isn't a better long-term solution to simply have DNSSEC distribute your site's public key? The idea that I have to buy a domain name and an SSL certificate is silly. For extended validation, what should be verified is your public key, not your domain. So if the public key is also signed by a number of CAs, it is considered valid.

View on HN

This thing is as old as DEFCON 2011 (see http://blog.thoughtcrime.org/ssl-and-the-future-of-authentic...) but in view of current events of certificate trustworthiness, there is quite a chance for anything that can successfully replace the approach of trusting CAs.

Please view this blog entry (from the core author of convergence.io) to get the idea of also why DNSSEC is not a good approach (he had put it in the way that it's worse than CAs.)

But how do I know which DNS servers to trust?

The ones with signatures that check out. That's the SEC part of DNSSEC. The root key(s) are published and you can verify authenticity all the way down.

Reply on news.ycombinator.com