4 ms·
To give an example of how things get better in the real world: Let's Encrypt won't issue a certificate if your DNSSEC records are invalid.
by dbrgn 8y ago
To give an example of how things get better in the real world: Let's Encrypt won't issue a certificate if your DNSSEC records are invalid.
- rocqua 8y agoSadly, if you can spoof DNS replies, you can probably strip the DNSSEC records. You need fail-closed systems for security, but fail-closed systems are not user friendly, and thus won't be accepted.
- Ajedi32 8y ago> if you can spoof DNS replies, you can probably strip the DNSSEC records You can't. DNSSEC has explicit protections against that.
- rocqua 8y agoThose don't work if you claim to be a non DNSSEC compliant resolver. Should clients really fail closed when faced with a non DNSSEC resolver they got from e.g. the starbucks WiFi DHCP? And if they should, do you really think they will? Because users will complain loudly.
- Ajedi32 8y agoClients, no. Certificate Authorities like Let's Encrypt, yes. (And in fact, they already do behave that way.)