3 ms·
I'm not sure what that would solve. You would still need some central entity to sign the DNS TXT record, to ensure that the HTTPS client does not use a tampered
by akovaski 10mo ago
I'm not sure what that would solve. You would still need some central entity to sign the DNS TXT record, to ensure that the HTTPS client does not use a tampered DNS TXT record.
- tzs 10mo agoIf someone can tamper with your DNS TXT records now they can get a certificate for your domain.
- franga2000 10mo agoNot tamper with the record directly, but MitM it on the way to a target.
- crote 10mo agoThat's what DNSSEC is for.
- franga2000 10mo agoYes, but that's just PKI again, which is what the OP was trying to avoid.
- ishouldbework 10mo agoThat should be prevented by dnssec no?
- tptacek 10mo agoDepends on who your adversary is. If it's your ISP: no, DNSSEC doesn't prevent that (in every mainstream deployment scenario, your upstream DNS recursive server is the only thing really doing DNSSEC validation).
- arp242 10mo agoThat's already the case with dns-01 verification, no? Besides, if someone has access to your TXT records then chances are they can also change A records, and you've lost already.