dane-pgp

358 ms·

3781.
by dane-pgp 10y ago
I don't think that growth and employment being "ever so slightly up" gives the full picture here. The value of Stirling hit a 31-year low after the vote, which obviously made the UK an attractive market for overseas buyers (
3782.
by dane-pgp 10y ago
And EasyDNS have a blog post[0] about why it actually is a good idea (disclosure: I agree). [0] http://blog.easydns.org/2015/08/06/for-dnssec/
3783.
by dane-pgp 10y ago
"Trusting all the existing CAs" is literally the status quo, though, right? So whatever it is you are proposing as a replacement needs to be strictly better than that. I've made my case for how DANE is better, but what exac
3784.
by dane-pgp 10y ago
I readily accept that we need Certificate Transparency deployed, not least to deter malfeasance in the DNS (which is a more tractable problem as the list of TLDs is relatively small and well known in advance). Hopefully you also accept tha
3785.
by dane-pgp 10y ago
In fact, next month's Icelandic government could be the Pirate Party, but I would rather trust Iceland not to elect an anti-privacy government than trust all CAs in the world not to be subverted by any anti-privacy government (indeed,
3786.
by dane-pgp 10y ago
In a CA world, every TLS certificate for a site under . is validated through trusting the CA, and the USG, which controls various CAs capable of issuing certificates for any site, can silently swap in its own identity for that of any of tho
3787.
by dane-pgp 10y ago
(a) The fact that I can't (or won't) get a fake cert for Google Mail doesn't really prove anything. I am not the NSA. I assume you wouldn't accept the challenge if I asked you to produce a fake (but cryptographically v
3788.
by dane-pgp 10y ago
Why are you so focused on "all of .COM's TLS keys" when, under the current CA system, all TLS keys for all domains go straight to NSA and any government that controls a CA (e.g. Turkey and China, etc.)? A situation where peop
3789.
by dane-pgp 10y ago
If you are relying on the CA system to secure your website, it is equally insecure no matter what TLD your site is under. DNSSEC at least gives you the possibility of moving away from .COM, .ORG, etc to a top-level you trust. You still hav
3790.
by dane-pgp 10y ago
I trust the Icelandic government more than the least trustworthy of all the CAs trusted by my browser (plus the least trustworthy of all the governments that have power over any of the CAs trusted by my browser). Alternatively I could (in t
3791.
by dane-pgp 10y ago
Because we can avoid registering a .co.uk domain, but we can't stop a foreign government forcing a Certificate Authority to issue a certificate for our domain. If the US government were to force the root zone key holders into issuing a
3792.
by dane-pgp 10y ago
The question of whether DNSSEC "puts control in the hands of whatever government controls the domain" was addressed in the first link I sent: http://blog.easydns.org/2015/08/06/for-dnssec/#gover
3793.
by dane-pgp 10y ago
That's great, but if you really wanted to clear up any doubt about your credibility, could you provide an estimate for how much it would cost an adversary to crack a 1024 bit RSA key within 90 days? You seem to suggest that's a s
3794.
by dane-pgp 10y ago
If you read the "Deployment Schedule" in that second link, you'll see "Sept. 20 [2016]: The first 2048-bit ZSK will be pre-published in the root zone." Looks like the prosecution might only have a few weeks of rest.
3795.
by dane-pgp 10y ago
I don't demand that you be "nice about DNSSEC". :) But if you want to be credible then it might help if you said something more accurate than "1024 bit RSA". http://blog.easydns.org/2015/08&#x
3796.
by dane-pgp 10y ago
If you're going to spread the "Against DNSSEC" FUD, it would be useful to give people the opposing viewpoint: http://blog.easydns.org/2015/08/06/for-dnssec/ It's also worth pointing o