4 ms·
That question is so broad. It entirely depends on what you want to use DNS for, and authenticated data allows it to be trusted for more use cases. Right now we
by bluejekyll 8y ago
That question is so broad. It entirely depends on what you want to use DNS for, and authenticated data allows it to be trusted for more use cases. Right now we have a system that from a security standpoint can’t stand on its own (given the internet community’s fight over DNSSEC), but yet is more widely deployed than pretty much any other protocol.
Shouldn’t we harden that, and allow it to be used independently of requiring systems to connect to some other centralized system over HTTPS?
- tptacek 8y agoNo. What would the point be? You'd still need TLS. DNSSEC isn't even encrypted, and even if it were, it's still only addressing the name lookup. Meanwhile, TLS was designed to assume the DNS is insecure, and has worked that way for decades. Try a thought experiment: imagine the root DNSSEC keys are published to Pastebin tonight. What happens? What blows up? I think, apart from DNS operators (maybe?), you'll have trouble identifying a company who would have to do anything.