3 ms·
Isn't DNSSEC trivially defeated right now, as any machine will accept a non-signed DNS record currently? I don't see any rush to get in on that, if you can beat
by ultramancool 12y ago
Isn't DNSSEC trivially defeated right now, as any machine will accept a non-signed DNS record currently? I don't see any rush to get in on that, if you can beat DNS with an MITM, you can just as easily downgrade DNSSEC right now. We're many years away from DNSSEC actually being viable, if it ever will be. Wait till it's actually being enforced by OS-level resolvers or there's simply no threat model in which it is beneficial.
- marcosdumay 12y agoWell, not defeated, but bypassed. It's still extremely easy to use it securely, just refuse to load a non-signed record. But, of course, it's not really desirable to do that for any query, just for the ones you care about.