4 ms·
Fortunately, SSL/TLS (with HSTS) does not depend on your local DNS resolver being secure.
by pfg 9y ago
Fortunately, SSL/TLS (with HSTS) does not depend on your local DNS resolver being secure.
- Piskvorrr 9y agoFail-safe is indeed the preferred option here, yet the resulting Denial of Service is still unpleasant.
- Someone1234 9y agoHSTS only works if you have visited the site before or it is hard coded (see Chrome and Google services for example). Reality is that DNS remains and will continue to remain a giant hole in TLS.
- pfg 9y agoAll major browsers implement HSTS preloading, and getting added is quite simple. A very large percentage of your average internet user's traffic is covered by this.
- pixl97 9y agoPreloading is a problem waiting to happen. It works fine when only a small portion of the internet uses it. But when you have 2 GB preload file with a few billion entries things are not going to work so well.
- pfg 9y agoThe idea is to make HTTPS the default before that happens. In the meantime, you can fit a lot of domains into bloom filter-like data structures.