3 ms·
It seems pretty clear to me that the industry, and particularly the slice of the industry that operates large, important sites and staffs big security teams, do
by tptacek 8mo ago
It seems pretty clear to me that the industry, and particularly the slice of the industry that operates large, important sites and staffs big security teams, doesn't believe this is a meaningful problem at all.
I agree with them.
- thenewnewguy 8mo agoWould this article not be evidence the part of the industry that makes up the CA/B Forum (i.e. CAs and Browsers) disagree?
- throwway120385 8mo agoYeah but CAs want to sell you certificates, and browsers compete on their support for those certificates.
- ekr____ 8mo agoHuh? They really don't. It's actually kind of unfortunate that browsers don't have uniform policies about what certificates they accept, but for obvious reasons each browser wants to make their own decision.
- kbolino 8mo agoThey do have uniform policies, those policies come from the aforementioned CA/Browser Forum, which has been issuing its Baseline Requirements for over a decade.
- tptacek 8mo agoThe fact that it's 2026 and the CAs are only now getting around to requiring any CA to take DNSSEC, which has in its current form been operational for well over a decade, makes you take DNSSEC more seriously?
- thenewnewguy 8mo agoWhy dodge the question? Clearly they care today, and I live in today. If we're doing to defer to industry, does only the opinion of website operators matter, or do browsers and CAs matter too? Browsers and CAs tend to be pretty important and staff big security teams too.
- rstupek 8mo agoAre they requiring DNSSEC in order to acquire the certificate? That would be a better indicator to me that it's not security theater=security
- tptacek 8mo agoNo CA requires DNSSEC. Obviously they can't: almost nothing is signed. The only change "today" is that technically CAs are now required to honor DNSSEC, where they weren't before.
- indolering 8mo agoWhich is really unfortunate, since it's pretty easy to do.
- tptacek 8mo agoI agree that it's relatively easy for CAs to validate DNSSEC. I think the fact that they weren't technically required to, despite the sole remaining use case for DNSSEC being to protect against misissuance, is a pretty strong indicator of how cooked DNSSEC is.
- rstupek 8mo agoI think the fact they don't require it shows it's moribund. If cert providers (or google with their big stick of chrome) specified it is required to have DNSSEC to get a certificate, everyone would jump in line and set it up because there'd be no other choice.
- mindslight 8mo agoBig sites don't have the same concerns as individual end users, in this case specifically about centralized servers surveilling DNS queries. DNSSEC zone signing lets one resolve records without having to directly go through trusted (ie centralizing) nameservers. (If you run your own recursive resolver this just changes the set of trusted servers to the zones' servers). I've made this argument in the context of your poo-pooing DNSSEC before, and I don't expect you to be receptive to it this time. Rather I just really wish I could get around to writing code to demonstrate what I mean.