4 ms·
> DNSSEC doesn't actually protect DNS queries at their most vulnerable points That would make it useless if true. Correct. Clients do not validate DNSSEC and
by dogecoinbase 9y ago
> DNSSEC doesn't actually protect DNS queries at their most vulnerable points
That would make it useless if true.
Correct. Clients do not validate DNSSEC and clients cannot be made to do so until DNSSEC deployment is universal (at which point you still have several other problems).
- phicoh 9y agoYou are saying that the ssh client that I have that locally validates SSHFP records using getdns doesn't actually work because DNSSEC is not universally deployed? Strange if something I've been using for a couple of years cannot exist.
- dogecoinbase 9y agoYou are correct that using previously obtained information over a secure channel will allow you to continue connecting to an unchanged endpoint. Again, not helpful when connecting to new or changed endpoints over an untrusted path unless you assume that all endpoint implement the mechanism (and, of course, that you trust the CA).
- xorcist 9y agoSSH does not operate with trust-on-first-use when using DNSSEC. It will not store key information locally in that case, specifically to be able to operate with changed endpoints over untrusted networks.