3 ms·

I am focusing on DNS because this thread is about DNSSEC. The topic of doing it in to the TLS servers themselves is a tangent not relevant to this thread.

• tptacek 1y ago
  No, I'm sorry, that's not the case. You're focusing on DNS servers as the target for BGP4 attacks because if you didn't, you wouldn't have a rebuttal for the very obvious question of "why wouldn't BGP4 attackers just use BGP4 to intercept legitimate ALPN challenges". The thread is right here for everyone to read.
  • iscoelho 1y ago
    Yes, DNSSEC is designed to prevent DNS MITM via integrity. BGP hijacks lead to MITM. I am not sure where the confusion is.
    • tptacek 1y ago
      The weird thing you're doing where you pretend attackers won't just target ALPN challenges with BGP4?
  • saurik 1y ago
    DANE.