Hacker News Reader

Comment by tptacek | Hacker News Reader

DANE doesn't remove the requirement to get a 3rd party to vouch for your keys; it just locks you into one very specific 3rd party, one likely subject to de jure control of a state.

View on HN

It seems much less likely that even a well-funded state actor could silently subvert enough root servers, which exist in many countries, to significantly compromise DNSSEC before alarms were raised, than that CAs are actively compromised or are just bad at being CAs, resulting in a breach like this (which happens approximately all the time). And with regard to state coercion, some CAs are in fact state-run, by states most people would consider grievously corrupt.

More to the point I would trust IANA and ICANN, faults and all, to not screw up the DNS/DNSSEC root, much more than I trust every CA in the default browser trust stores to get X.509 right all day, every day.

Again: you don't have to touch the root servers. The root servers are a red herring here. It's the TLD operators who exercise all the real control. IANA/ICANN will have nothing to do with the resulting situation.

See my other comment above. A malicious TLD operator is not something everyone is just powerless to deal with.

Short summary of my response to that comment: you're wrong, and ICANN does not in fact have the real-world power to liberate .COM from the United States Government.

Unlike Google, Mozilla, Apple, Microsoft and the gazillion of US-based CAs who right now can mint certificates not just for .com but also for every other TLD? Those are all not beholden to the US government in your mind???

Guess which third party is already required to "vouch" for your in order to get a DV cert from the web PKI mafia?

Reply on news.ycombinator.com