3 ms·
SSL Certs are the biggest racket on the internet. Can anyone tell me why certs can't work in the same way as DKIM, where you include the certificate fingerprin
by shawabawa3 12y ago
SSL Certs are the biggest racket on the internet.
Can anyone tell me why certs can't work in the same way as DKIM, where you include the certificate fingerprint in a DNS text record? Is DNS not secure enough? and if not why is it good enough for email?
- detaro 12y agoDNS is not secured in any way (by default, DNSSEC is not that widely deployed yet and also not without flaws), therefore putting the fingerprint in DNS does nothing for protection against man-in-the-middle attacks. DKIM is vulnerable against that, but the impact of doing so is lower (breaking anti-spam vs being able to intercept HTTPS)