Comment by darkwater
2 days ago
It seems a nice thing to have indeed, but domain registrars have already a history to cede control and bend to $GOVERNMENT. We have countries already trying to MiTM all their citizens by mandating CAs injection in every device under their jurisdiction, what would be the defense against this threat in a world where registrars hold the keys to TLS encryption for the web on the TLDs they own as root? I'm not that expert in this field so I really would like to learn if it's possible.
Government can compel servers in its jurisdiction to use a mandated CA. DNS would nicely compartmentalize it to the zone controlled by that government as opposed to the CA system where every random eMudhra CA has infinite reach.
That's true, but I still think that in a "government goes dictatorial" scenario, where for example there is already a widely usage of up to that moment perfectly safe ccTLD websites and services, they could MITM all of them more easily just going to a single place, and doing it in a manner more difficult to uncover.
Although I'm not sure where a specific domain private keys would be hold in DNS in this case, and that could make my point moot.
Example: an green-haired guy is elected President of Zootopia [1] but not all the State branches are still under his power, but he can force the .zoo registrar to release all their private keys so it can siphon all the encrypted data going back and forth .zoo domains that are used by other State branches, and blackmail them or find out how they are organizing.
[1] yeah I know it's a city in reality
Not that it isn't an interesting question but what's preventing them now? You can get a certificate for any domain you control. It is just really obvious if you abuse that power. Which shouldn't really change with DNSSEC I think.