Re: [apps-discuss] "finding registered domains"

[Phillip Hallam-Baker <[e-mail]>]

I think that there are two separate sets of security requirements here
and there is therefore a need to be able to state either

* This domain is a public delegation point
* This domain is NOT a public delegation point.

Andrew's proposal seems to be limited to the security issues of
cookies. I think there is a much better way to solve the security
problems of cookies, one that is guaranteed to be 100% reliable,
albeit not one that is likely to be acceptable...

The reason I want both types of assertion is that we use the public
suffix list in a different way when we are issuing a certificate and
the security concerns are rather different as a result. In particular
CAs are only ever going to consider information retrieved from the DNS
as 'evidence'. It is never going to be considered to be 'proof' and
never relied on to the exclusion of any other information.