3 ms·

I think RPKI is good enough. As we have TLS on top it doesn't need to be perfect.

• maltalex 6mo ago
  Only with certificate pinning or something similar. Otherwise, the attacker can get valid TLS certificates for any domain hosted on the hijacked IP addresses.
• rot256 6mo ago
  For LetsEncrypt, routing is authentication: if packets routed to the IP in the A record end up at your place, you can get a cert for that domain.
  • gerdesj 6mo ago
    DNSSEC and DNS-01 challenges might do the trick at the cost of significant effort, provided LE could be directed to check, similar to the way MTA-STS works.
    • fanf2 6mo ago
      Let’s Encrypt has been doing DNSSEC validation for years. DNSSEC could have prevented the jabber.ru MITM attack.
• zymhan 6mo ago
  Those two things address orthogonal issues