Tuesday, January 06, 2009

When the trust in DNS went missing...

We need something else.

...DNSSEC is about creating a "chain of trust," adds Ram Mohan, CTO of Afilias, which has been working to help the Public Interest Registry handle its deployment. There are many places where DNSSEC must be switched on in order for the chain of trust to flow unbroken from the user to a website. Once a top-level domain (such as .org or .com) implements DNSSEC, any website under that domain can choose to turn on DNSSEC as well, which is an important link in the chain. Since Internet service providers such as Comcast have started supporting DNSSEC, Mohan says, it's becoming possible for some website visits to fall largely under the protection of DNSSEC.

More from A New Web of Trust in MIT's Technology Review.

No comments: