Hacker News Reader

Comment by itistoday2 | Hacker News Reader

> It's disingenuous to argue that Google and Mozilla implement PKP simply to protect their own properties.

The post didn't name specific companies or products, but on that note, is there a list of sites that Chrome and/or Firefox have pinned somewhere? I don't think TACK has been implemented in them.

The thing with TACK is that it doesn't actually solve the key distribution problem. The draft itself states:

   TACK pins are easily shared between clients.  For example, a TACK
   client may scan the internet to discover TACK pins, then publish
   these pins through some 3rd-party trust infrastructure for other
   clients to rely upon.

Keywords: "some 3rd-party trust infrastructure"

That is what DNSChain and the blockchain provides. It provides more than that though, and thus providing everything that TACK proposes too.

View on HN

This is a misrepresentation of TACK. TACK will ordinarily be deployed similarly to HSTS: it's a key continuity scheme, like SSH. It doesn't require a "third party trust infrastructure". But unlike the CA system, TACK also supports the notion of a third-party root; the EFF could run a site that would provide trustworthy pinned keys for arbitrary sites on the Internet, and you could subscribe to that site.

Contrast to DNSChain, which requires that ordinary users trust a third-party server.

DNSChain isn't going to happen.

the EFF could run a site that would provide trustworthy pinned keys for arbitrary sites on the Internet, and you could subscribe to that site.

So how do you know that your subscription to EFF is secure?

Contrast to DNSChain, which requires that ordinary users trust a third-party server.

First-party, not third-party. What you described with EFF is a third-party, whereas DNSChain is a first (or 2nd) party, because either you own the server (1st party), or your friend does (2nd? party).

DNSChain isn't going to happen.

It's already happened. I'm using it right now. Where's TACK?

You're playing semantic games with "first party" and "second party" and "third party".

If I didn't think EFF was trustworthy, I wouldn't subscribe. Key continuity would still make TACK valuable; even without trusted third parties, widespread deployment of TACK would practically eradicate dragnet surveillance through compromised CAs, because every attempt to forge a certificate would quickly be detected.

You're playing semantic games

I am not. Those words have real meaning that doesn't disappear when you accuse me of playing semantic games.

If I didn't think EFF was trustworthy, I wouldn't subscribe.

I asked how do you _know_?

With DNSChain, you actually have a great deal of certainty that is based on math, not public reputation.

widespread deployment of TACK would practically eradicate dragnet surveillance through compromised CAs, because every attempt to forge a certificate would quickly be detected.

With DNSChain there are no compromised CAs to eradicate, and therefore no problem. You also get to keep your money, no more need to pay for SSL certificates.

Ok, you have fun with that.

Reply on news.ycombinator.com