2 ms·

If browsers someday decide to implement some DANE-like feature, it would quickly become a fairly high percentage. There would still be a rather long period whe

by comex 7y ago

If browsers someday decide to implement some DANE-like feature, it would quickly become a fairly high percentage. There would still be a rather long period where browsers would have to continue to trust Web PKI certificates in general, even assuming they decided to phase them out. But... during that time, anyone using DNS over HTTPS with a trustworthy resolver would presumably get the right TLSA records, so their browser would reject attackers’ certificates even if validly signed by the Web PKI, no?

tptacek 7y ago
That's an answer to the "hypothetical someday" question, but I'm interested in what the number would be today.
- comex 7y ago
  Then the answer is approximately 0%, right? But what does that prove? Perhaps DANE is not ready yet, or perhaps it’s struggled to get adoption because its design is fundamentally flawed; you’re versed on the details, I’m not. But to me that seems pretty orthogonal to whether “adding one more” is good or bad, or whether DANE’s design is fundamentally superior to the CA model as cryptonector claims. Or at least it’s a very oblique way to make a point about that.
  - tptacek 7y ago
    My objection, which, mea culpa, I stated obliquely, is to 'cryptonector's subtext that DANE is a reasonable thing for an actual operator to pursue in 2019. We can't even generate a workable draft for how a browser would implement DANE in 2019, let alone see it implemented in a browser. Huston is probably right that the failure of this draft takes DANE off the table for another couple years† --- a couple more years in which DNSSEC can't do the one thing DNSSEC people think it's most valuable for. How many years have to pass before we give up on this boondoggle? We're coming up, within this next 12 months, on twenty five. Do we wait for year thirty to finally, formally declare time of death? I'm fine either way. But I'd say we passed the mark where people can casually pretend that DANE is something anyone should expect to get value out of at least five years ago. So I take umbrage at the tone of that comment above, that "it's OK that DANE adds one more CA to the mess of CAs we already have because some people will lock their sites down to DANE-only". Well, no, no they won't, because that's akin to taking your site off the Internet, and that will remain the state of play indefinitely (probably forever). † and that assumes that after the IETF figures out how to specify stapled DANE that the major browser vendors will adopt it; the evidence points the other way.
- sanxiyn 7y ago
  That's a very strange thing to be interested in.

by comex 7y ago

tptacek 7y ago

That's an answer to the "hypothetical someday" question, but I'm interested in what the number would be today.

comex 7y ago
Then the answer is approximately 0%, right? But what does that prove? Perhaps DANE is not ready yet, or perhaps it’s struggled to get adoption because its design is fundamentally flawed; you’re versed on the details, I’m not. But to me that seems pretty orthogonal to whether “adding one more” is good or bad, or whether DANE’s design is fundamentally superior to the CA model as cryptonector claims. Or at least it’s a very oblique way to make a point about that.
- tptacek 7y ago
  My objection, which, mea culpa, I stated obliquely, is to 'cryptonector's subtext that DANE is a reasonable thing for an actual operator to pursue in 2019. We can't even generate a workable draft for how a browser would implement DANE in 2019, let alone see it implemented in a browser. Huston is probably right that the failure of this draft takes DANE off the table for another couple years† --- a couple more years in which DNSSEC can't do the one thing DNSSEC people think it's most valuable for. How many years have to pass before we give up on this boondoggle? We're coming up, within this next 12 months, on twenty five. Do we wait for year thirty to finally, formally declare time of death? I'm fine either way. But I'd say we passed the mark where people can casually pretend that DANE is something anyone should expect to get value out of at least five years ago. So I take umbrage at the tone of that comment above, that "it's OK that DANE adds one more CA to the mess of CAs we already have because some people will lock their sites down to DANE-only". Well, no, no they won't, because that's akin to taking your site off the Internet, and that will remain the state of play indefinitely (probably forever). † and that assumes that after the IETF figures out how to specify stapled DANE that the major browser vendors will adopt it; the evidence points the other way.
sanxiyn 7y ago
That's a very strange thing to be interested in.