3 ms·
> and does not cede to the US Government control over TLS keys Hold on. This is actively conflating DNSSEC and DANE. I know your point that the "main feature"
by FiloSottile 11y ago
> and does not cede to the US Government control over TLS keys
Hold on. This is actively conflating DNSSEC and DANE.
I know your point that the "main feature" of DNSSEC is enabling DANE, and I respect that. But the two domains are still distinct: DNS security and the PKI built on top of that.
DNSCrypt only addresses DNS security, so it should be compared to pure DNSSEC, which obviously does not "cede to the US Government control over TLS keys".
- sarciszewski 11y agoFilo: How do you feel about pushing for enabling DNSCrypt on your DNS servers, and working with the folks at Mozilla to make sure Firefox supports it? ;)
- tptacek 11y agoI don't agree with you. The top-down PKI DNSSEC expresses is inextricable from the DNS lookup security it attempts to provide. That DNSCrypt does a better job of solving lookup security without resorting to a government-controlled PKI is germane.