3 ms·
Persona is already using DNS for resolution, just very badly. I just went looking. There's a whole thread over here: https://github.com/mozilla/persona/issues
by inopinatus 13y ago
Persona is already using DNS for resolution, just very badly.
I just went looking. There's a whole thread over here:
https://github.com/mozilla/persona/issues/1523 https://github.com/mozilla/persona/issues/1523 & https://groups.google.com/forum/#!msg/mozilla.dev.identity/dP44TDzBnhI/3MijAKI1oR8J https://groups.google.com/forum/#!msg/mozilla.dev.identity/d...
where the developers effectively shitcanned the idea of using SRV records because they fear DNSSEC. Hilariously ignoring the huge elephant in the room viz. that they were already relying on DNS to resolve endpoints.
The verification, the trust, comes from TLS with a valid cert, and that doesn't change, however you located the https listener in the first place.
Even better, though, if you did use DNSSEC you can validate a self-signed cert via DANE/TLSA rather than having to buy one from CrappyCA. And that would make the ISPs very happy.
- StavrosK 13y agoAs I explained in issue 1523, the above is misunderstanding Persona and conflating various issues, and is wrong. Pretty much the only way Persona uses DNS is to perform an A lookup to get the user's domain, which could be SRV (or have an SRV fallback instead). The issues above talk about delegation, which is a whole other matter.
- inopinatus 13y agoNo, that is exactly what I'm saying. It should be an SRV lookup to find the support document. This solves a lot of problems. No misunderstanding here. You may actually be in total agreement with me.
- StavrosK 13y agoI am in agreement with you, but the misunderstanding is about DNSSEC, etc. The only reason SRV records are not used for that is probably that nobody suggested it (it's a good idea, you should probably open an issue).