3 ms·

Sounds a lot like DANE/TLSA.

by posixplz 9y ago

mschuster91 9y ago
Oh cool, haven't read about this one before. Wonder why it didn't get picked up despite being a standard :(
- rocqua 9y ago
  The basic reason is that people really don't like DNSSEC. tptaeck (https://news.ycombinator.com/user?id=tptacek https://news.ycombinator.com/user?id=tptacek) has plenty of comments really supporting that argument.
  - dane-pgp 9y ago
    I won't say he's wrong, but he presents a very one-sided view. It's worth reading the responses to criticisms like his: https://www.easydns.com/blog/2015/08/06/for-dnssec/ https://www.easydns.com/blog/2015/08/06/for-dnssec/
- detaro 9y ago
  DANE is used a bit for SMTP (where it also forms a clear "only talk to our mail servers over TLS" signal, which as far as I know didn't exist before) As a replacement for HPKP it doesn't solve the big attack scenario of someone taking over your DNS and obtaining a certificate to impersonate your site: if they can do that, they can also put false certificate details in DNS. It's also tied to DNSSEC, which isn't universally deployed for domains, would if I understand correctly putting a full DNSSEC-resolver in the browsers to protect against local MITM (which isn't practical in many situations) and often criticized.
- hannob 9y ago
  > Wonder why it didn't get picked up despite being a standard :( It doesn't work on the real internet, only on some fantasy internet that merely exists in the head of DNSSEC advocates. Basically you can only do DNSSEC if you can receive arbitrary DNS records. That's not the case for a non-negligible portion of Internet accesses, where those queries get filtered. Adam Langley has pointed this out years ago: https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html So if you want to deploy DANE you can choose between falling back to insecure (so it's entirely pointless) or breaking the Internet for a large fraction of users. Neither is a very good plan.
  - lmm 9y ago
    The same could have been said about HTTPS 10 or even 5 years ago - a significant portion of internet users couldn't access it for one reason or another. And yet we're managing to transition to an HTTPS- only web. No reason DANE couldn't be progressively deployed the same way.

Sounds a lot like DANE/TLSA.

mschuster91 9y ago

Oh cool, haven't read about this one before. Wonder why it didn't get picked up despite being a standard :(

rocqua 9y ago
The basic reason is that people really don't like DNSSEC. tptaeck (https://news.ycombinator.com/user?id=tptacek https://news.ycombinator.com/user?id=tptacek) has plenty of comments really supporting that argument.
- dane-pgp 9y ago
  I won't say he's wrong, but he presents a very one-sided view. It's worth reading the responses to criticisms like his: https://www.easydns.com/blog/2015/08/06/for-dnssec/ https://www.easydns.com/blog/2015/08/06/for-dnssec/
detaro 9y ago
DANE is used a bit for SMTP (where it also forms a clear "only talk to our mail servers over TLS" signal, which as far as I know didn't exist before) As a replacement for HPKP it doesn't solve the big attack scenario of someone taking over your DNS and obtaining a certificate to impersonate your site: if they can do that, they can also put false certificate details in DNS. It's also tied to DNSSEC, which isn't universally deployed for domains, would if I understand correctly putting a full DNSSEC-resolver in the browsers to protect against local MITM (which isn't practical in many situations) and often criticized.
hannob 9y ago
> Wonder why it didn't get picked up despite being a standard :( It doesn't work on the real internet, only on some fantasy internet that merely exists in the head of DNSSEC advocates. Basically you can only do DNSSEC if you can receive arbitrary DNS records. That's not the case for a non-negligible portion of Internet accesses, where those queries get filtered. Adam Langley has pointed this out years ago: https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html So if you want to deploy DANE you can choose between falling back to insecure (so it's entirely pointless) or breaking the Internet for a large fraction of users. Neither is a very good plan.
- lmm 9y ago
  The same could have been said about HTTPS 10 or even 5 years ago - a significant portion of internet users couldn't access it for one reason or another. And yet we're managing to transition to an HTTPS- only web. No reason DANE couldn't be progressively deployed the same way.