Without DV certs, much of the web might not be encrypted at all.
replyI think few independent site owners would go through the more costly and complicated EV process.
Bingo... that was muchly the case prior to Let's Encrypt's introduction. They single handily changed prevailing practices outside of big tech.
replyThat's a bit of an exaggeration. Domain-validated certificates already existed, and were fairly commonplace, before Let's Encrypt. What was different about LE was that their certificates were free.
replyMost independent site owners couldn't obtain an EV certificate even if they wanted to - the process effectively requires that the applicant be a business.
reply> For DV, if you can successfully MitM every connection to a destination, then you _do_ own the domain.
replyThat's a policy, not an inherent consequence of DV certs.
If every verification method other than DNS was shut off, it would still be DV, but with care it could be immune to MitM. I'm not advocating for that, but it's an option.
It wouldn't be immune to MitM on DNS - unless DNSSEC were to become mandatory.
replyDon't focus too hard on the current method. Just work with me and imagine a value that comes direct from the registry and there's some kind of secure link, maybe DNSSEC maybe not.
replyWithout major cross-national legal changes, OV/EV certificates on the open web are pointless at best and misleading to the point of being dangerous at worst. They remain quite useful in specific scenarios outside of normal web browsing, but that's not the issue at hand.
replyI liked the idea conceptually of CAA record only allowing DNS validation. Then use DNSSEC.
replyI say “conceptually” since I know: 1. Actual attacks found with CT have used compromised TLDs, which kills the whole thing anyway, and 2. I haven’t really seen where the hosting company’s infrastructure (BGP ads and internal routing) is what’s compromised. Well certainly in the latter case they can probably also get in to the hosting machines directly.