3 ms·

Many years ago, when HTTPS adoption was in the 5% range, if someone would have said “HTTPS is the ultimate defense against web page spoofing”, would you have ar

by teddyh 3y ago

Many years ago, when HTTPS adoption was in the 5% range, if someone would have said “HTTPS is the ultimate defense against web page spoofing”, would you have argued that it was false, just because the adoption was so low? DNSSEC is the ultimate defense against cache poisoning attacks, no matter the adoption percentage.

tptacek 3y ago
You should go tell Google that.
- teddyh 3y ago
  The needs and risk profiles of Google are vastly different than basically every other organization on Earth. (I also note that you didn’t answer my question, and instead opted for a rhetorical cheap shot reply to my second paragraph only.)
  - tptacek 3y ago
    Never mind. It's OK. I don't think we're speaking the same language, so to say.
    - teddyh 3y ago
      I think your posting style of making confident statements, but responding to counter-arguments with rhetorical cheap shots and condescending non-answers, is unsuitable for HN.
      - tptacek 3y ago
        I don't think personal attacks are helping your case, Teddy.
        teddyh 3y ago
        Criticizing specific behavior as being unsuitable for HN is not a personal attack.
- Hazelnut2465 3y ago
  Google is aware and has enabled DNSSEC on their recursive resolvers for a long time. Unfortunately, most people do not DNSSEC sign their zones, so Google have to resort to also enabling 0x20, which is helpful, but also (to an extent) security theater.
  - tptacek 3y ago
    "People" in this case includes Google, which does not sign its zones.