4 ms·

If that happened, we'd revert to pre-DNSSEC security levels: an attack would still be hard to pull off (unless you own a root DNS server or are reliably in the

If that happened, we'd revert to pre-DNSSEC security levels: an attack would still be hard to pull off (unless you own a root DNS server or are reliably in the path to one). It's like knowing the private key for news.ycombinator.com - it still doesn't do anything unless I can impersonate the Hacker News server. But that was still enough of a risk to justify TLS on the web. Mostly because ISPs were doing it to inject ads.

tptacek 1y ago
We are demonstrably in "pre-DNSSEC" security levels today. DNSSEC has almost no serious adoption.
- iscoelho 1y ago
  That’s false. Any organization that enables DNSSEC for their domains gains its security benefits and prevents any potential DNS hijacking. At this point, your statements border on intentional dishonesty. Please be more truthful and responsible in your statements.
  - tptacek 1y ago
    This is an engineering/technical discussion and you're not going to be able to name-call your way through it.
    - teddyh 1y ago
      It's funny that you of all people should say that, as I have said the same thing to you a number of times when discussing DNSSEC.
  - Avamander 1y ago
    > That’s false. Any organization that enables DNSSEC for their domains gains its security benefits and prevents any potential DNS hijacking. Hijacking by whom? Very few are really running a validating recursive resolver.