Hacker News new | past | comments | ask | show | jobs | submit
For starters, limit CAs to a specific scope. It's pretty insane a Chinese or Indian CA can certify websites in the Netherlands.

In the 90s vision of a truly globalised world that might have made sense but in today's geopolitical reality it's insane.

If this had been in place already, instead breaking the internet this would have been purely a regional issue.

We have DANE, but that's reliant on DNSSEC (which is suboptimal and basically unused outside of a few TLDs).

We also used to have HPKP but that was killed because anyone who could take over a site temporarily could pin their own key to all new visitors and then hold the website ransom even after the owner got a hold of their domain again.

Honestly, if we just patch up DNSSEC to work around its current limitations, we could already use DANE and be done with it. Put the (ECC) public key in the HTTPS record your client is looking up anyway and you're basically there.

oh no you want some trendy .in or other domain name? sorry can't use your favorite CA, got to use the crappy one that leaked keys
Well yeah, or have the website define which CA they use, and don't let any of the others certify it. Apparently there is already DANE for this but webbrowsers don't check it.

Besides, there could be more CAs supporting .in of course. And it becomes a matter of responsibility to the local government.

And national TLDs aren't meant to be trendy anyway. Many have restrictions on them to local businesses anyway, it would make sense to have the local domain authority have control over choosing CAs as well.

loading story #50203056
loading story #50203956