4 ms·
One year of DANE – tales and lessons learned [pdf]
- mike-cardwell 11y agoIf anyone wants to test DANE with SMTP, I have it set up on grepular.com. Feel free to email me. Details in my profile.
- falcolas 11y agoDoesn't this simply move the issue of trust up to the DNSSEC certificate holders? What is to stop them from creating the same abuses of identity which affect TLS as presented early in the slides?
- marcosdumay 11y agoJust like CAs, nothing stops them. Except that the site owner can choose what provider he trusts, and only the chosen entities can abuse that trust.
- detaro 11y agoBut it takes someone "up the tree" from your domain to be compromised/evil, vs with CAs any generally trusted CA can create a cert for your domain. While it doesn't help against everything, it still improves things. (OT: does anyone know a good German/European domain registrar/DNS provider that offers DNSSEC without jumping through too many hoops?)
- feld 11y agoGandi does (France) Maybe Joker if you want German
- toast0 11y agoThe number of parties capable of abusing trust in DANE are more strictly limited to the domain registrar, the domain registry, and the root registry (ICANN). Maybe your DNS provider as well, depending on how your records are arranged so they can be signed. You can choose your registrar and potentially your registry, if you're willing to use a different TLD. It's not perfect, but it limits the number of parties that can impersonate you down to three from hundreds.