4 ms·
Motivations are important, but your response does not address the technical issues brought up by the parent comment. Initial discovery uses DNS, so wouldn't un
by Sephr 8y ago
Motivations are important, but your response does not address the technical issues brought up by the parent comment.
Initial discovery uses DNS, so wouldn't uncached hosts still be vulnerable to downgrade attacks without DNSSEC? MTA-STS seems to suffer from some of the same issues facing HPKP.
- tptacek 8y agoDNSSEC advocates also believe DANE is needed to address the weaknesses in things like HPKP and HSTS. Of course, nobody else does, no mainstream browser implements DANE, and at least two have attempted to support DANE and then withdrew that support.