4 ms·
So just to be clear, the thesis here is that we should not secure DNS in any way, correct? Or is part 2, in a series of articles going to detail a different sol
by IgorPartola 12y ago
So just to be clear, the thesis here is that we should not secure DNS in any way, correct? Or is part 2, in a series of articles going to detail a different solution?
In other words, is the objection to DNSSEC the idea, or the implementation?
Lastly, what is our best hope for getting rid of CA's?
- tptacek 12y agoThe thesis here is in fact that we should not secure DNS in any way, just like we don't secure raw IP and won't for the foreseeable future secure BGP4. We instead do what we've done for 20+ years: assume the network is untrustworthy (because it is, with or without DNSSEC) and build security on top.
- IgorPartola 12y agoThanks for clarifying! I have followed many of the discussions in which you participated talking about this issue, but this is the most concise way this has been put. If I may suggest something, the article talks a lot about the implementation flaws in DNSSEC, giving the impression that if only it was designed better, or even redesigned, that we could actually have a secure DNS.