4 ms·
DNSSEC is a compromise because of backward compatibility, but the alternative is not signing at all. > almost none of the largest, best-funded security teams i
by LeonM 8y ago
DNSSEC is a compromise because of backward compatibility, but the alternative is not signing at all.
> almost none of the largest, best-funded security teams in the world bother DNSSEC-signing
Do you have any sources to back your claim about this? I'm having a hard time believing that the best-funded security teams prefer weak authentication over no authentication.
- tptacek 8y agoSure. Go to the Verizon DNSSEC Analyzer site and type in the domains of giant banks, like BankOfAmerica.com and Chase.com. Those are companies with security teams consisting of hundreds of people, and "authentication" is something they spend fuckloads of money on. None of them are DNSSEC-signed. It's 2018. You think maybe they're just late to the party? No: they've decided not to do it, the same way the browser teams decided not to support DNSSEC in their libraries or UX.