Hacker News Reader

Comment by jamiesonbecker | Hacker News Reader

It'd be nice if we could distrust the whole CA system and start from scratch. (of course, to everyone who is saying to themselves that this is absurd and unrealistic.. yes, of course you're right.. for the moment.)

It seems pretty clear that the future lies in the blockchain.

View on HN

That's pretty much what Google announced today:

https://news.ycombinator.com/item?id=12784295

(Certificate Transparency is basically a Blockchain. And this may be one of the few cases where a blockchain-like technology actually makes sense.)

Ben Laurie, who co-invented CT, claims not to favor blockchains (especially with proof-of-work), e.g.

http://www.links.org/files/decentralised-currencies.pdf

He seems to have argued that CT's log works on different principles, although surely it's influenced by all of the revitalized consensus work that's happened after the Bitcoin paper.

How does the blockchain solve the problems with CAs?

Haven't you heard, you can solve any problem by throwing a blockchain at it! ;-)

On a more serious note, Certificate Transparency, which will become mandatory in Chrome in about a year, uses technology that is strongly related to blockchains, so we're really not too far from a blockchain-like solution for the Web PKI.

A global, permanent, public, append-only log for 11 cents a record is pretty useful.

I agree that CT uses a technology related to blockchains, but as I noted above, Ben Laurie has been pretty vocal in saying that the Bitcoin-style PoW blockchain isn't a technology that he favors, and I think he thinks CT is importantly different in some respects (for example in accepting more centralization in the operation of logs: an uninvolved anonymous party can't show up and "mine" a CT log event).

http://www.links.org/files/decentralised-currencies.pdf

Not the OP, but I imagine he has something like namecoin in mind. Domains are tied to cryptographic keys which are also used for encryption+authentication, and the blockchain stores the mapping of names to keys.

It's not ready for primetime, and it has its own issues. I don't really see it gaining much traction. But it does present an alternative approach to the problem.

How do you tie a domain to a key in this model? That's the specific thing that CAs do. The Wikipedia article seems to hand wave over this and I don't see an obvious answer on the namecoin site (though I assume it's there if I dig enough).

I don't know if there are established formats to do it, but you would publish the public key in the namecoin record of your domain. You can only do that if you currently own the name in the namecoin chain, similar to how DANE would put a key into DNS.

You register a domain by spending namecoin in a reg tx, which becomes immutable in the bc. Problem is that when a court says Cocacola.blockchain_namespace is the legal property of the Coke, and the owner is some kid in China who won't hand over the keys, no Corp would use it for DNS.

Names should be strong to prevent spoofing but not so strong that squatters and unlawful holders of keys can disrupt their legitimacy.

So basically it doesn't at all solve the problem. Immutable domain names are not a good thing in general (though certainly in specific cases it could be), especially when as you noted squatting is inevitable.

Reply on news.ycombinator.com