3 ms·
Tell you what; I’ll answer your new question if you answer my original question which you evaded: Why are HTTPS keys not “security theater”, but DNSSEC keys ar
by teddyh 3y ago
Tell you what; I’ll answer your new question if you answer my original question which you evaded: Why are HTTPS keys not “security theater”, but DNSSEC keys are? (Details in my comment upthread.)
- tptacek 3y agoBecause people generally do manage their own TLS keys. Everybody who has ever set up Certbot and LetsEncrypt has done so. You've misconstrued my argument about this, which says only that people who have domains autosigned by their registrars aren't a meaningful contributor to DNSSEC deployment, not that the huge share of DNSSEC deployment that those people represent is a sign that all DNSSEC key management is performative security theater. My argument is simpler and more limited than you've taken it for. Now, to my question? Again: it seems like a very broad, very easily falsified argument. Who, other than DNSSEC providers themselves, would need to be paged if the DNSSEC root keys ended up on Pastebin? Be specific, if you can? Seems like this should be easy to answer!
- teddyh 3y ago> people generally do manage their own TLS keys. What? No, most people do not run their own web server. Most people have their web site on a web host, and lets the web hoster manage it, including the TLS keys. Just like with DNS and the DNSSEC keys. > Who, other than DNSSEC providers themselves, would need to be paged if the DNSSEC root keys ended up on Pastebin? I freely admit that I don’t know. Beside ICANN, I’m guessing all the TLD operators, since their records can now be spoofed with impunity. But, I guess you could also ask: What would happen if, say, the keys for the X.509 certificates for google.com was leaked?