WoSign's secret purchase of StartCom: WoSign threatened legal actions

As a bonus, determining the shadyness of a domain based on the TLD is something even many regular end users can be capable of, because it is so visible. End users never look at SSL CA chains, but the TLD is visible front and center.

Until then I am very much against start mistrusting DNS as a precautionary measure based on FUD.

> they start coming up with real, more decentralized and trust-less systems

Sounds intriguing, how should this work? There are some ideas out there, but they all have major drawbacks. So it will take time and a real, present threat for people to start using it regardless of the drawbacks.

That's not new; it just makes plain what has always been the case. Better to have it out in the open, IMO.

The legacy non-CC TLDs (.COM, .NET, etc.) are essentially US territory for historical reasons -- .COM should really be ".CO.US" but the latter will probably never catch on, and the ship has sailed at this point -- and anything under .UK is the UK's, obviously. If you don't want your DNS controlled by a FVEYs country, probably best not to use a TLD that's under one of those countries' control.

Setting up something in .COM that's likely to be objectionable to the US government is as unwise as setting up something that the Chinese government is going to find objectionable in .CN DNS space.

The idea that the Internet would ever somehow transcend nations, when it relies on infrastructure that lives in the physical world which is dominated by nation-states, was a naive piece of 1990s idealism. The fact that the Internet lets you basically choose your jurisdiction is a great thing, and shouldn't be undervalued. I don't think there has ever been a time when a person in the US could so easily set up a publication that's protected under the laws of (say) Finland, or Russia. (Of course, they do so at their own personal peril, if they live in the US; again, there's no escaping nations, just choosing between them or hiding.)

I am not totally sold on the DNSSEC+DANE concept, but the fact that it admits reality as it exists on the ground, which is that the Internet exists of and in the world and not above it, does not strike me as a particularly compelling criticism.

I'm all for trying to reduce the need to trust one's government, but I think this is getting out of hand.

Currently, if you really want to trust the little https lock icon, you need to trust your government, pretty much everyone else's government, a whole lot of non-governmental companies of which many are demonstrably untrustworthy, and anyone who can hijack internet traffic well enough to spoof domain validation. And you need to trust everyone with control over DNS, because they can very easily spoof domain validation. That's a lot of people, any of whom can force a certificate.

With DANE, you need to trust the DNSSEC roots and the hierarchy from the roots to your domain. That's it.

So the argument that Verisign and your registrar (and presumably your government) can potentially defeat DANE is an argument against a ridiculous straw man: Verisign and your registrar can defeat the existing system just as easily.

At least with DANE, a whole bunch of other governments, registrars, AS operators, etc can't also impersonate your web site.

If a zone is DNSSEC signed and I query its records regularly(i.e. they stay in the cache) it would be very hard to spoof their records. If I also use a recursive resolver that does DNSSEC validation(e.g., 8.8.8.8) it's even harder. I'm not quite willing to say it would be impossible, but AFAIK no one has shown it to be possible.

By that logic, because someone could write a browser that will accept invalid certificates and/or show everything as secure etc, TLS in general is fundamentally broken so we should never use it.

A bad implementation isn't reason to abandon the concept.