4 ms·
You can’t fix STARTTLS unless receivers stop advertising it. That will take until the end of time. Meanwhile, DANE can assure that domains can assert their SSL
by ttul 4y ago
You can’t fix STARTTLS unless receivers stop advertising it. That will take until the end of time. Meanwhile, DANE can assure that domains can assert their SSL certificate in the DNS securely. And MTA-STS can allow DNS to do so, just without the assurance of DNSSEC, which implies that sophisticated man-in-the-middle attacks can still occur, if DNS can be intercepted and modified.
- tptacek 4y agoIt's probably worth noting that the attacks a state-level actor would use to subvert MTA-STS are more sophisticated than the attacks those same actors would use to subvert DNSSEC, which is a global tree PKI whose roots are de jure controlled by state actors.