Hacker News Reader

Comment by Ajedi32 | Hacker News Reader

I don't see how you can have actual "proof of domain ownership" without secure DNS, or some kind of similar PKI. Right now they don't check for proof of domain ownership at all, just whether you have temporary, de facto control of the DNS record or the network it points at. This usually works well enough, but won't do anything if a MITM attack occurs on the server side rather than the client side.

View on HN

There's a whole design space of options here, one of the simpler ones being just checking via the registrar, using a protocol like RDAP. You could also use the DNS for this, but not require the entire zone to be encrypted (you'd be designing a new protocol, but that's what we have to do anyways, since DNSSEC is a dead letter).

Yes. That would fall under the "some kind of similar PKI" category I mentioned, as you'd still need some kind of PKI to secure the RDAP connection. (Perhaps that PKI could be simpler than full DNSSEC, but it would have to solve a lot of the same problems.)

For RDAP to work (for instance) you only need to bootstrap with secure connectivity to the registrars. Current DV challenges have a much harder problem: they have to work with every zone on the Internet. There's no real reason to accept that constraint!

When we think about "sound engineering" this is the level we need to start at, not "what features could we bolt on to core Internet infrastructure to define the problem away".

The people most avidly pushing DNSSEC for this problem aren't stupid. They're just smuggling in an additional premise: that the WebPKI itself is bad, and should be replaced with a DNS PKI. Seen through that lens, secure proof of domain ownership would be deeply problematic, as it would leave the DNS PKI with literally no reason to exist.

Yes, if you're okay with doing away with the concept of zone delegation beyond the top level domains, you can make proof of ownership a lot simpler and just validate directly with the registries.

If you want to keep zone delegation, your proof of ownership PKI is going to end up having to solve many of the same problems DNSSEC tries to.

And the thing is, once you have a secure, automated way for websites to prove ownership of a domain, the necessity of trusting a bunch of third party CAs to validate that information for you starts to become questionable.

Reply on news.ycombinator.com