3 ms·
> "The CA system is worse" isn't a rebuttal to "DNSSEC/DANE gives the USG direct control of certificates". Again, please stop the overly broad statements and e
by danyork 12y ago
> "The CA system is worse" isn't a rebuttal to "DNSSEC/DANE gives the USG direct control of certificates".
Again, please stop the overly broad statements and explain precisely HOW "DNSSEC/DANE gives the USG direct control of certificates". I've not yet been able to have someone explain to me how this is true. I put my cert (or a fingerprint) in a TLSA record signed by my DNSSEC key in my DNS zone. Where does the USG get involved?
- tptacek 12y agoThe DNS hierarchy secures all the data in your zone.
- danyork 12y agoMaybe it's just that I'm deliriously tired, but I'm still missing how "the DNS root" can alter the data in MY zone sitting on my little authoritative server somewhere. Can you please walk me through the actual attack? As someone else pointed out, all the root can do is potentially redirect a TLD to a controlled TLD registry, which could then conceivably serve out NS records for my domain pointing to an owned authoritative DNS server... which could then serve out bogus data. BUT... I have to think someone would notice the redirected TLD!
- tptacek 12y agoWhy? Why do you think someone would notice that? The attacker is going to do everything they can to prevent you from noticing.