Hacker News new | past | comments | ask | show | jobs | submit
advisedwang | on: eMudhra to exit global SSL/TLS certificate business
How does a client know what public key to expect for a given domain, then?

If they key is distributed by DNS, then you need to secure DNS, e.g. with DNSSEC. Well, with DNSSEC the TLDs and root basically have the same status as CAs (although it does cut down the huge number of CAs that can issue certs).

account42 | parent | next
At least there is only one DNS root so we can work on securing that (or just pin the certts for the next level for anything that has any update procedure whatsoever).
tptacek | parent
It does, but you also lose 100% of the accountability. eMudhra is leaving this business because the root programs are about to humiliate them. There are no programs anywhere that can do the same thing to a major TLD operator.
kensey | root | parent | next
If ICANN decides you no longer operate the TLD, and takes your name servers out of the root server zones and replaces them with somebody else's... you don't run that TLD any more, sorry, go have a good cry and then see if maybe running a hot dog stand is more your speed. DNSSEC is one of the services ICANN considers critical enough to take away your TLD stewardship if you aren't providing that service properly.

Of course we wouldn't want ICANN to do that on a whim, or without having a new operator for the TLD ready to go, but there's already process defined for both planned and emergency transfers of operation of a TLD:

https://www.icann.org/en/contracted-parties/registry-operato...

tptacek | root | parent
ICANN is not going to tell the USG (or, for identical reasons, Verisign) that it no longer operates .COM. This particular deus ex machina is fanciful.
kensey | root | parent
You don't think so? In a scenario where it becomes known the US government is actively subverting Verisign to tamper with DNSSEC integrity (or where Verisign just screwed up badly enough to make their continued stewardship untenable, and I think either case would become known, in pretty short order), I absolutely think ICANN would expatriate .com. If they didn't, they would lose legitimacy with everybody who isn't the US government. That leads to at best an international effort to replace ICANN and at worst the splintering of the DNS root. Nobody wants either of those scenarios -- the least-damaging thing for the Internet and for ICANN as an organization would indeed to be to take .com away and let say, the British run it for awhile. (Maybe you could get your .com domain registrations at Sainsbury's, in the aisle next to the anti-demon plant misters.)

Which is exactly the kind of scenario a lot of people hyperventilated about back when ICANN was formed, for reasons of varying validity, but in this case it would indeed be the least-worst option all around.

loading story #50200047
tptacek | root | parent
I am 100% confident that .COM will not be rescued from law enforcement and national security surveillance by ICANN, yes.

You can disagree! But then: let's just keep the premises clear. You think DNSSEC makes sense because you also think states will lose control over their registry operators.

kensey | root | parent
Not lose control exactly. But if ICANN is willing to, they have the power to simply make that control irrelevant in any specific case. The government in question would have absolute control of a TLD registry that no one else considers authoritative for that TLD. If you're a hermit kingdom like North Korea anyway, that's probably not a big deal, but for anybody else it's liable to be a very big deal indeed.

I would expect ICANN to use that power very sparingly, preferring to publicize rather than act as a first step, and if they did get heavy-handed, again they would incur a hit to their legitimacy.

The only reason it's considered unthinkable that could happen to .com is that everybody agrees it's unthinkable to do that to .com. But ICANN absolutely could make a credible threat to US control of .com or .us if they felt it warranted to do so. (You could say they're ICANN, not ICANN'T.) They could do the same to .gov, for that matter, but the US government already explicitly owns and controls that whole hierarchy, so there's no real "interference" issue there.

The whole Internet's viability is based to some extent on the collective delusion that everybody agreeing this is how it works, actually makes it how it works. But none of that is set in stone... which is generally a good thing.

tptacek | root | parent
We're at a level of counterfactual and divergent premise where there's really not much I can contribute to this arm of the conversation. My response to "ICANN would seize control of .COM adversarially from Verisign" is "ICANN and what army?" and by that I mean literally "what army?"
loading story #50209695