4 ms·

Deploying DANA doesn't mean that we can't use HPKP. It is independent solution. > Chrome has mid-high double digit market share. No matter what the DNS hierarc

Deploying DANA doesn't mean that we can't use HPKP. It is independent solution. > Chrome has mid-high double digit market share. No matter what the DNS hierarchy says, and no matter what some random CA says, Chrome ships knowing what a valid certificate for Google Mail looks like. When you try to tell Chrome something is a Google property that isn't, Google finds out, and they take action. And this situation won't change with DANA. > HPKP does not give a fuck what government is currently in power in Libya. If a CA starts issuing bogus .LY certs, that CA probably isn't going to be issuing certificates for .LY --- or many anything else --- for much longer. If they control DNS for domain, they can change MX records for verification and buy certificate in any legitimate CA.

tptacek 10y ago
DANE does harm HPKP. Part of the point of HPKP is that when pins are broken, browsers can punish CAs. You can't punish the TLDs that way. HPKP assumes agility. DANE removes agility. Equally importantly: DANE doesn't actually solve any problem we have today. HPKP does. Why would you spend a penny, let alone tens of millions of dollars, to deploy something that is a step backwards for our security? What's the point? Regarding MX records: I think you need to re-read the post, its FAQ, or the comments on this thread, because it's been addressed ad nauseam.
- garaetjjte 10y ago
  With DANE there will be no CAs, so yes, there will be no CAs to punish. But owners of root zone can already change DNS records to buy certificate in any CA, and you cannot punish them for that because they aren't required to do any validation above checking DNS records for non-EV certs. In worst case DANE is equally secure as current CA system (ok, except that weak RSA, but I hope it will be fixed soon). Why you want to keep CAs, when you have to waste resources on constantly monitoring and punishing them, while with DNSSEC you can ditch them? In both systems DNS root zones owners can buy/generate certificates for child zones. This was also addressed ad nauseam.
  - tptacek 10y ago
    At this point we're just repeating ourselves, so I think we're done.

tptacek 10y ago

DANE does harm HPKP. Part of the point of HPKP is that when pins are broken, browsers can punish CAs. You can't punish the TLDs that way. HPKP assumes agility. DANE removes agility. Equally importantly: DANE doesn't actually solve any problem we have today. HPKP does. Why would you spend a penny, let alone tens of millions of dollars, to deploy something that is a step backwards for our security? What's the point? Regarding MX records: I think you need to re-read the post, its FAQ, or the comments on this thread, because it's been addressed ad nauseam.

garaetjjte 10y ago
With DANE there will be no CAs, so yes, there will be no CAs to punish. But owners of root zone can already change DNS records to buy certificate in any CA, and you cannot punish them for that because they aren't required to do any validation above checking DNS records for non-EV certs. In worst case DANE is equally secure as current CA system (ok, except that weak RSA, but I hope it will be fixed soon). Why you want to keep CAs, when you have to waste resources on constantly monitoring and punishing them, while with DNSSEC you can ditch them? In both systems DNS root zones owners can buy/generate certificates for child zones. This was also addressed ad nauseam.
- tptacek 10y ago
  At this point we're just repeating ourselves, so I think we're done.