3 ms·
Yes, I was indirectly making the point that against such an adversary both systems are equally threatened (although there may be malicious actors less capable t
by dane-pgp 10y ago
Yes, I was indirectly making the point that against such an adversary both systems are equally threatened (although there may be malicious actors less capable than a nation state that can spoof a DNS response).
One difference you didn't mention, though, is that with DNSSEC the domain owner can choose which TLD they register under, whereas it is less common for a site to specify which CAs are allowed to issue certificates for it (especially in a way that works if the browser hasn't visited that site yet).
- tialaramex 10y agoThe mechanism by which sites (well, domains) can specify which CA may issue is named CAA, it's part of DNS and is an IETF standard. However, the current Baseline Requirements for trusted CAs don't actually require them to check CAA unless their declared policies say that they check. Let's Encrypt's policies say so, as do Symantec's but many others do not. Gerv (of Mozilla) is trying to get this changed, either by industry agreement in the BRs, or de facto by changing the Mozilla root programme rules if the CAs try to block changing this in the BRs or keep stalling too long.