3 ms·
DANE is really interesting. Wider adoption would be good for everyone I think. I’m going to have to give this a try.
by brightball 5y ago
DANE is really interesting. Wider adoption would be good for everyone I think.
I’m going to have to give this a try.
- dagenix 5y agoThe problem with DANE is that it doesn't move us away from CAs, it just conflates the role of running a DNS zone with also being a CA. And even CAs may be problematic, the entities running DNS zones are often more so.
- mike_d 5y agoIf you own a DNS zone, you should be the only one with the authority to issue certificates for it. That is what Handshake+DANE does.
- dagenix 5y agoFair enough - I missed the part about Handshake. I don't know much about Handshake, but, if it does what I assume it does, I do see how DANE would make sense in that context. Whether or not Handshake is a good idea I guess is the real discussion point - but, maybe one I'm not too interested in debating, especially given my limited knowledge.