Hacker News new | past | comments | ask | show | jobs | submit
Anything that doesn't eliminate the current model of "a whole pile of CAs of unknown and widely-varying reliability are ultimately-trusted by every TLS client in the world despite the numerous times that has caused serious problems for approximately everyone on the Internet" is IMHO not significantly better than what we have now. The trust is the problem, and shorter certificate lifetimes or restrictions on usage flags or the various other things trying to work around that issue don't solve it no matter how many of them are implemented -- they're bandaids on a shotgun wound.

But let's whiteboard for a bit: if you agree (as I assume you do) that the current situation is at least more insecure than it should be, and should ideally change fundamentally, and if you don't think DANE is the right fundamental change, what would you implement instead if you had the magic wand to make everyone agree to do it?

I would verify domain ownership using something other than DNS, and devise something more reliable than CAA records to lock down issuance authority. But I can't say enough how much I think DANE would be a direct step backwards for trustworthiness on the web. We would be immediately worse off in multiple ways. Any argument in favor of DANE has to work around the unreliability, the weak cryptography, and, most importantly, the lack of transparency.