Subject: [webfinger] Certificate Authorities (was Current HTTP/HTTPS Language)

From: "Paul E. Jones" <[email-masked]>
Date: Sun, 16 Dec 2012 19:41:52 -0500

> > FWIW, I'm in the same boat.  My personal email address is at
> > danga.com, which doesn't currently serve on https, so I'll have to do
> > the Startcom dance for that, just for WebFinger.
> >
> > I likewise hope that more free SSL options become available, so we're
> > not reliant on them or the other "30-day-free" options.
>
> i hope we can join forces with folks from CAcert and other related
> project to help fixing current situation with CAs... any suggestion in
> which corner of cyberspace we can collaborate on this issue?

I mentioned before that there is another option: DNSSEC + DANE.  I can appreciate why people would not put trust in CACert.  It has nothing to do with the integrity of the people running the service, but the fact that they're not part of the "inner circle" of CAs.  If there happened to be one unscrupulous person in the group that issued a certificate to somebank.com, who is liable for the damages?  It presents a problem for the bank, for the CACert organization, and for the whole industry, really.

DNSSEC + DANE puts the security in the hands of the domain owner, as they issue their own certificates.  The trusted entities with DNSSEC are the domain owner itself, the provider of DNS services (which might be the domain owner), the registrar, and the DNS path leading to the root.  These have to be trusted with the current CA approach, since many have to power to create a certificate or manipulate DNS responses to allow themselves to get a certificate from a CA.

DNS offers a huge MITM attack plane.  Why the world has not made firm steps to move to DNSSEC, I don't know.  I've never seen a bank that used DNSSEC, for example.  I flipped the switch on packetizer.com, so at least your DNS servers can verify my DNS records.  But very, very few domains utilize DNSSEC and some registrars do not even support it.

Paul