5 ms·
In other words, IPSEC is useless without DNSSEC, and that isn't getting universal adoption anytime soon.
by azernik 12y ago
In other words, IPSEC is useless without DNSSEC, and that isn't getting universal adoption anytime soon.
- cesarb 12y agoOh, no, it's useful for what it's designed for: to protect communication between two computers. If I have IPSEC protecting the connection between my desktop and my internal DNS server, and between my desktop and my database server, I know that connection to my database server is protected by IPSEC. It doesn't protect the mapping between a computer name and a IP address, but that's not its job.
- bsder 12y agoNo, IPSEC is useless because the ISPs broke the end-to-end nature of the internet which IPSEC assumes as a starting point. So, IPSEC is a non-starter.
- acdha 12y agoI think it's more like IPsec hasn't happened because it's a huge hairball of complexity which requires kernel-level configuration on every client and full end-to-end support for two new IP protocols and a UDP key management service. In contrast, TLS requires using a new client library and works just about everywhere. All of the work people have been doing to switch to strong crypto everywhere and deploy things like perfect-forward security? Imagine how quickly that'd have happened if it required everyone to install a kernel update. Until IPsec becomes easier to use (something as simple as checking that a socket is actually secure used to be shamefully under-documented) the best way to think of it is as a potential replacement for proprietary VPN protocols. Anything which cares about security will still need TLS over that so most people will simply use only TLS.