Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

Convergence and DNSChain are two interesting proposals to replace the CA system.

IMO, it's more important to emphasize the idea of secure origins, and HTTPS hits that note. TLS could be swapped out, the CA system could be changed, but what matters is the expectation that connections across the web are expected to be secure by default.



Agreed.. it's a shame that I can't just publish a public-key as part of a DNS entry for a domain, and as long as the DNS chain is secure (DNSSEC) then that key can be trusted.


DNSSEC is just replacing one set of roots (the CAs) with another (the root servers).

At least with CAs you can (theoretically) remove trust from a subset of them and things (mostly) keep working.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: