4 ms·
> Also, this ignores the main argument against DNSSEC / DANE: Incorrect. You can sign your own root zone anytime you like, and we could see alt-roots if the r
by cryptonector 5y ago
> Also, this ignores the main argument against DNSSEC / DANE:
Incorrect. You can sign your own root zone anytime you like, and we could see alt-roots if the root misbehaves.
- tptacek 5y agoDNSSEC: it's secure as long as you don't trust the DNS hierarchy.
- cryptonector 5y agoFallacious argument. With WebPKI there are many roots that can MITM you. With DNSSEC there is only one. Once we have CT for DNSSEC it will be easier to watch that root and the CA for each label in the domainname on the way to the QName than it is to watch tens of CAs in WebPKI.
- tptacek 5y agoDid you accidentally respond to the wrong thread? I do that all the time. The thread you're commenting on is one where the previous commenter suggested that you could mitigate DNSSEC's reliance on a government controlled PKI by substituting your own DNS roots.