Subject: Re: [websec] Use of DNS/DNSSEC for strict security

From: Sam Caldwell <[email-masked]>
Date: Wed, 13 Oct 2010 21:14:31 -0500

DNSSEC is a good start, but I would suggest that no amount of work on WEBSEC
can truly secure the web until the integrity of the browser and server are
guaranteed.  It would seem that the focus of WEBSEC should not start with
DNSSEC, as DNSSEC is but one front of the battle.  Instead, I would suggest
that WEBSEC should start by first requiring compliant web servers and web
browsers (and their extensions) to be digitally signed by a mutually trusted
certificate authority, and that thereafter the WEBSEC standard should
provide a mechanism for validating these digital signatures.  Over time,
digitally signed browsers and servers can provide a mechanism for
blacklisting known malicious servers AND malicious browsers.  Further, each
client-server relationship can be encrypted using PKI with a lower industry
cost.