5 ms·
Could dust off DANE here, the connection probably already included a DNS lookup, why not get the public key info from the same.
by devman0 2y ago
Could dust off DANE here, the connection probably already included a DNS lookup, why not get the public key info from the same.
- tptacek 2y agoSo many reasons, but the simplest is that those lookups will constantly fail because middleboxes makes variegated inane decisions about 53/udp and 53/tcp, which means you need to have a fallback mechanism, which will inevitably be exploitable. DANE is a dead letter.