Re: [keyassure] publishing the public key

[Martin Rex <[e-mail]>]

Henry Story wrote:
> 
> > The current approach of admins to run a TLS server with a bare public
> > key is to generate themselves a self-signed (X.509v1) Certificate.
> > That is probably what many folks are doing when protecting Web access to
> > their HomeNAS, Home DSL-router, Home DVB-s receiver, etc.
> > 
> > This works with the installed base, in particular with the installed
> > base of servers.  Though it doesn't work that well with Web Browsers
> > as clients.  In particular, many recent browers are pretty badly broken
> > when it comes to a sensible UI for servers using a self-signed cert.
> 
> Indeed, and this is why keyassure is going to be so useful for those people. 
> They must just be itching to pop their public keys in DNSSEC as soon as the 
> first browser vendors implement it. So you are guaranteed a large community
> to spread the word and give you feedback. And I think Browser Vendors will
> be very keen to implement this, as well as DNSSEC of course, given the
> terrible state of DNS.

Not at all.  The average Home user (private home DSL subscriber) is
not a DNS admin, let alone a DNSSEC admin.  So for accessing the Web-UIs
Home devices/equipment/gadgets, DANE will be mostly irrelevant.

But maybe some of the Browser maintainers fix their UIs and start
to distinguish direct access to local resources on private networks
(such as 192.169.x.x and 10.x.x.x and hostnames without domains attached)
from access to resources on the internet.  And stop behaving like nagware
for commercial CAs.

-Martin