WingNews logo WingNews
top | item 5003838

(no title)

loungin | 13 years ago

Do you know of any alternatives being worked on? No snark intended, I am genuinely curious about the current state of affairs.

discuss

order

jcase|13 years ago

Some developments in this area are:

* Convergence.io

* DNS-based Authentication of Named Entities (DANE) + DNSSEC

* Tack.io

For various reasons listed in [1] Convergence is not likely to be implemented (by default) in major browsers.

On DANE + DNSSEC, where the cert is authenticated via the information published in your DNS, Moxie Marlinspike has said it better then I can:

    "CAs are sketchy, but this is a whole new world of sketchiness. Think,
    sketchasaurus. Registrars were never built or selected with security in mind,
    and most of them don’t have a very good track record in this area. Shouldn’t it
    be laughable that the current first step in deploying DNSSEC is to create an
    account with GoDaddy?"[2]
The 2011 BlackHat video[3] and blog post[2] by Moxie Marlinspike are great sources of information.

IMO, Tack.io is the most viable solution. It's compatible with the current model but removes the thread of one CA being able to compromise all domains.

[1] http://www.imperialviolet.org/2011/09/07/convergence.html

[2] http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...

[3] http://www.youtube.com/watch?v=Z7Wl2FW2TcA

richardwhiuk|13 years ago

Registrar's are trusted. They can change the DNS records for your domain to point at their servers, allowing them to intercept email. That's sufficient to allow them to get certificates issued for your domain through some providers.

__david__|13 years ago

There's also CurveCP (http://curvecp.org/) which is a more radical alternative (replaces TCP and relies on DNSCurve, a DNS replacement) but has good security built in by default and some interesting features (remote users are identified by their public key so they can reconnect from different IP addresses and the stream keeps going without a reconnect).

It seems like a much harder thing to get adoption going for but it has good thought behind it and can exist in parallel with the rest of the TCP/IP world. I would love to see it get to a place where you can just download it from Debian or Homebrew...

tquai|13 years ago

I've been using CurveCP for over a year privately and love it. I'll probably expand to production, starting with CurveHTTP, with the next release of NaCl. Not sure if that makes me the chicken or the egg.