-
Notifications
You must be signed in to change notification settings - Fork 90
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Consider DANE as an alternative to Certificate Authority #15
Comments
This sounds very interesting indeed. I look forward to seeing whatever you come up 🚀 |
I have DANE proper configured on my personal website, as well as lightning address. |
@Falci are you able to point to the right place if I wanted to test using it through DANE? Not too familiar with it myself. |
When we make an https request, programmatically or via browser, the SSL is automatically verified. But basically, the client making the request needs to verify the SSL's fingerprints against a DNS record. To check the DNS record (secured by DNSSEC):
And to retrieve the cert's fingerprint:
Useful links: |
Hi there, I love the lightning address proposal, I just have an idea to add.
This proposal is similar to BIP70 in that it relies on out-of-band authentication based on DNS and Certificate Authority systems. I think this external authority was one of the reasons the Bitcoin community was uncomfortable with BIP70, which was eventually removed from Bitcoin Core in bitcoin/bitcoin#15584
I contribute to an altcoin project with the goal of securing an alternative DNS root zone on its PoW blockchain. We have also embraced the useage of the
/.well-known
pattern for serving wallet addresses (HIP-0002) but since no Certificate Authorities recognize our root zone, we use DANE to anchor all TLS connections.DANE is controversial to legacy internet engineers because it just sort of trades one central-authoritarian security model (CA) for another (DNS). However by using blockchain-based domain naming systems like Namecoin, Handshake and others, we believe DANE has a new life and we can achieve secure http connections using TLS but without any central authority at all.
Anyway! I just wanted to put that idea on the table, I'm happy to help you develop it. I have been running LND since it was available on mainnet, connected to a local Bitcoin Core full node. Later on this month I'll try experimenting with lightning-address using a Handshake domain, secured by DANE ;-)
The text was updated successfully, but these errors were encountered: