2 ms·

It failed on this case, so it must equally fail in every? I don’t buy that ..

• eropple 8y ago
  No. The assertion is that it does fail to provide a benefit in practical, real-world cases, but defends against a fairly niche attack. There's a reason that 'tptacek called it "security theater". Its implementors could better spend that time on actual security measures for things that are much more likely to happen...like defense in depth for credential leaking.
• rocqua 8y ago
  It protects against targeted DNS poisoning, but that is already covered by TLS.
  • ancarda 8y ago
    How is that protected by TLS? Wouldn't you need a good A/AAAA record to make a connection to a TLS server? Or do you perhaps mean DNS over (TLS|HTTPS)? I never saw that as a complete replacement for DNSSEC; it provides transport security, yes, but how do we know we aren't talking to a malicious resolver? Maybe that's not as much of a threat if people aren't using DNS servers from their ISP -- which sometimes inject ads or otherwise tamper with traffic.