4 ms·
DNSSEC validation is part of chrome; http://www.imperialviolet.org/2011/06/16/dnssecchrome.html http://www.imperialviolet.org/2011/06/16/dnssecchrome.html DNS
by colmmacc 15y ago
DNSSEC validation is part of chrome;
http://www.imperialviolet.org/2011/06/16/dnssecchrome.html http://www.imperialviolet.org/2011/06/16/dnssecchrome.html
DNSSEC is about end-to-end authenticity for DNS data, and one of those ends is the user application, so it's understandable that a burden of responsibility would shift towards it. TSIG is about transport security, it's not about data authenticity, I wouldn't describe it as an alternative - it is complementary to DNSSEC.
If DNSSEC succeeds, then doubtless there will be some successful in-application libraries and APIs for performing this - and those state machines won't be something we all have to worry about. But yes, it does shift the work-load.
- tptacek 15y agoNo, a single feature that exploits DNSSEC validation is part of Chrome. Securing DNS with "end-to-end authenticity for DNS data" is like securing the web by signing every individual web page.
- danyork 15y agoPlugins/extensions are available now for both Chrome and Firefox that provide a visual indicator in the address bar: http://www.internetsociety.org/deploy360/resources/how-to-add-dnssec-support-to-google-chrome/ http://www.internetsociety.org/deploy360/resources/how-to-ad... http://www.internetsociety.org/deploy360/resources/how-to-add-dnssec-support-to-mozilla-firefox/ http://www.internetsociety.org/deploy360/resources/how-to-ad... But, to your point, these are not built-in and require a user to actually install the extensions. And of course, a user can ignore the key icon (as some ignore the lock-in and SSL/TLS popups).