Hacker News new | ask | show | jobs
by yup_sto 566 days ago
I know this is an oversimplification, but if the main issue is the single point of failure (centralized trust), wouldn’t a potential solution be to layer independent verification mechanisms on top of the current system?

For example, a secondary DNS-based verification layer where a site’s public key is published as a DNS record (though that would likely need DNSSEC to be effective). It seems like it could complement the existing CA structure without replacing it entirely.
2 comments
woodruffw 566 days ago
The problem with the CA system is arguably not that it’s a single point of failure: it’s that it’s N points of failure, all of which were originally unaccountable to user agents. The CAs are themselves decentralized entities, and each was largely unaccountable to the larger web PKI until CT came along.

I think a DNS layer would probably make that problem worse, not better, which is one of the enduring criticisms of DNSSEC and DANE.

link
yup_sto 566 days ago
You're likely right here, combining two trust systems does add complexity without solving the core problem. While browsers requiring CT was a great step forward, it's surprisingly under-utilized by orgs. I wonder if this is due to limited tooling for log interaction, or just general lack of awareness?
link
tptacek 566 days ago
It's pretty widely used; orgs that have security teams with more than a handful of people tend to be monitoring CT for their own names. Could it be more usable? Yeah, there's probably more than one startup in there. Have at it! You don't need anybody's permission to build something like that.
link
j16sdiz 566 days ago
> wouldn’t a potential solution be to layer independent verification mechanisms on top of the current system?

CT[1] allows some kind of external audit, but this is _mostly_ after the fact.

DNSSEC have much worse trust issue.

[1] https://certificate.transparency.dev/howctworks/

link