3 ms·
But DNSSEC is pretty much a false sense of security. See the copious and lengthy critiques on it from tptacek (here on HN) about it. However, this blog post (al
by SEJeff 10y ago
But DNSSEC is pretty much a false sense of security. See the copious and lengthy critiques on it from tptacek (here on HN) about it. However, this blog post (also from him) is a good start:
https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/
- microcolonel 10y agoGiven that the body which holds the root zone keys is the same body which delegated the zones in the first place, seems like it is about the best you can get with DNS itself. If we didn't trust the root, then DNS would be pointless anyway since end users would need to be mailed a public key before they could get any records. I do agree that DANE is a horrible idea for exactly the reasons he lays out though. I would never trade in private CAs for a PKI owned by either the UN or the U.S. Government (although USG would have some obligation not to suppress my zone without a court order, as I am a citizen). The UN is enough of a joke that they appointed Saudi Arabia to serve on the Human Rights Council (granted that expires next year); This year the Philippines joined.