22 Aug
2010
22 Aug
'10
2:38 a.m.
On Sat, 21 Aug 2010, ML wrote:
Would a future with a ubiquitous DNSSEC deployment eliminate the market for commercial CAs?
No, but it might eliminate the cheapest certs that people might use. I'd like my personal server to have a self-signed cert with it's fingerprint handled via DNSSEC, because I don't want to pay a CA.
Would functioning DNSSEC + self signed certs be more secure/trustworthy than our current system of trusted CAs chosen by OS/browser developers?
No, because DNSSEC isn't secured all the way from the DNS server to the application, only to the resolver. Both systems have problems, I'd imagine the best security is when they work together. -- Mikael Abrahamsson email: swmike@swm.pp.se