Comment by account42
2 days ago
And how many more times do we need to read news like this before we replace Web PKI with a system that isn't as completely insane?
We already have a functioning system for delegating domain ownership in a hierarchical fashion where compromises are limited to only the subtree under the compromised entity. Let's start using it for domain validation sooner rather than later.
Eek! You've summoned Tom Ptacek to tell you why it's obviously better (and simpler) to maintain a second, parallel system that trusts dozens of parties to sign for any name they feel like.
Of course we should have done that ages ago, but, you see, 20 years ago or so, Verisign (and maybe others) had a profit stream to protect and people to send to the IETF. And it's just possible there may have been other players with vested interests in things not getting too secure.