dnschain

> The blockchain can't fix this problem - it's too large for most embedded devices That's a wise observation, which is why we are making it accessible to such devices over a MITM-proof connection via DNSChain: https://github.com/okTurtles/dnschain

> The solution is absolutely not to have browsers accept self-signed certificates though. The solution is something nobody hasn't quite come up with. We do have a solution that does accept self-signed certificates. The remaining pieces need to be finished and the players need to come together though: https://github.com/okTurtles/dnschain If you're in San Francisco, come to the SF Bitcoin Meetup, I'll be speaking on this topic tonight: http://www.meetup.com/San-Francisco-Bitcoin-Social/events/18... Let's Encrypt seems like the right "next step", but we still need to address the man-in-the-middle problem with HTTPS, and that is something the blockchain will solve.

So, blockchain solutions do work, and here is how: https://github.com/okTurtles/dnschain You can replace all CAs with a single blockchain. And we should do this, because this Let's Encrypt CA, while a great step forward, is still vulnerable to man-in-the-middle attacks, explained in this video: https://vimeo.com/100433057

This maybe: https://github.com/okTurtles/dnschain

> software using namecoin for DNS resolution Actually, it should be the other way around: dnschain [0] bridges DNS resolution and namecoin, so there's no need to modify existing software. [0] https://github.com/okTurtles/dnschain

I think it depends on what you're comparing the current system with, right? I mean sure if its either no hoop jumping or you have to pay some money then you can go figure ok the person willing to give up bucks and go through the trouble is probably a little more reliable because of that. But how is that type of system ideal or secure? Currently, ssl certs give me very little assurance that any data over the connection is not being backdoored/sniffed to whomever, that the private certs arent compromised, etc. I think we shouldn't be trusting people because of hoops they go through, but because the system we use doesnt allow fraudelent players to stay in the game. Personally, I'd like to see it head in this direction: https://github.com/okTurtles/dnschainhttps://github.com/okTu... also for some more background on some concerns with CAs see:

Namecoin has been used for this purpose since 2011. It already has specifications for DNS and identities (and these have been iterated on for years now): https://wiki.namecoin.info/index.php?title=Domain_Name_Speci... https://wiki.namecoin.info/index.php?title=Identity As well as others (like hashes for software). Even OneName.io's u/ namespace is listed here: https://wiki.namecoin.info/index.php?title=OneName There are also many other blockchain DNS related projects: DNSChain (gives full-security read/write to arbitrary blockchains for all devices without having to run a DNS-based blockchain node, another nifty features like censorship circumvention and dotDNS metaTLD for JS apps): https://github.com/okTurtles/dnschain (I'm one of the devs of this) BitShares DNS (a different type of blockchain with a different consensus protocol): http:

There are alternatives - as long as you're willing to give up on regular DNS domains and use .dns or .bit domains: https://github.com/okTurtles/dnschain http://www.freespeechme.org/

You mean like this? https://github.com/okTurtles/dnschain

dnschain: https://github.com/okTurtles/dnschain

The blockchain, on the other hand, would: https://github.com/okTurtles/dnschain/blob/master/README.md#...

You should create .dns or .bit domains and encourage Iranian users to use DNSchain servers for DNS: https://github.com/okTurtles/dnschain

"Oh thank you Namecheap for giving us even cheaper pay-for-insecurity certificates!" Kinda sad. We deserve a better internet than this. Use the blockchain for free and actually secure certificates: https://github.com/okTurtles/dnschain

> It's terrible, because Man-In-The-Middle attacks are trivial and automatable. It's actually both terrible and the best security you can get. - Terrible because today's browsers participate in a pay-for-insecurity model, where any CA certificate can be used to compromise any website on the internet (except for the tiny number of hard-coded/"pinned" certs that some browsers ship for their company's websites). Certificate Transparency only makes the problem worse [1]. Browsers currently have no way to securely verify either self-signed OR CA-signed certificates. - It's the best security you can get because unlike certificates based on the aforementioned pay-for-insecurity "X.509 PKI" (public-key infrastructure), the security of a self-signed certificate depends on NO ONE except the issuer (i.e. _you_). Plus, they are 100% free. I like to r