danyork

28 ms·

241.
by danyork 12y ago
The idea would be to enable you to verify the public key of a server to which you are connecting for the first time. RFC 4255 outlines this use case: http://tools.ietf.org/html/rfc4255 When you first connect and get th
242.
by danyork 12y ago
tptacek: > Why on earth would anyone store SSH keys in a PKI controlled by NSA and GCHQ? How does that not make the argument against DNSSEC even stronger? Please remind me again how the NSA/GCHQ can subvert my domain at example.com
243.
by danyork 12y ago
> Maybe DNSSEC has nothing to do with privacy regarding DNS requests? DNSSEC has nothing to do with privacy. DNSSEC is entirely about the integrity of DNS requests. DNSSEC is focused on ensuring that the information you get OUT of
244.
by danyork 12y ago
jocluteseh - your site seems to be down now (perhaps buried under HN traffic). Perhaps post it as a gist on Github or something like that? https://gist.github.com/
245.
by danyork 12y ago
> 9. I'm not smart enough to understand what this argument means. Thomas, I _think_ you are replying to this: > 9. Wrong. SSH public keys, Email public keys, DKIM public keys... check your email headers from Google... they all ha
246.
by danyork 12y ago
I'll note that a main point of this document is to explain to people such as policy makers how we in the Internet technical community collaborate to address security issues. This is an effort by Olaf Kolkman to help policy makers unde
247.
Introducing Collaborative Security, our approach to Internet security issues(internetsociety.org)
1 points by danyork 12y ago|1 comments
248.
The plot to replace the Internet(spectator.co.uk)
2 points by danyork 12y ago|0 comments
249.
Working to Keep the Internet Open in Yemen(internetsociety.org)
2 points by danyork 12y ago|0 comments
250.
UNHRC Creates UN Special Rapporteur on “The Right to Privacy in the Digital Age”(internetsociety.org)
1 points by danyork 12y ago|0 comments
251.
by danyork 12y ago
So what do we do to fix the broken CA system? Particularly in a case where a bogus certificate is issued by an intermediate CA that rolls up to a root CA that is included in all the major browsers. It seems to me that we have several buildi
252.
by danyork 12y ago
Any CA can generate a cert for any domain. This is one of the problems with the current CA system.
253.
by danyork 12y ago
The article linked was a reaction TO Thomas's article. :-)
254.
by danyork 12y ago
Too funny... completely missed the snark in the midst of all the discussion here. :-) And you're right - HBO Now is only on Apple devices right now... so getting to the website from Android wouldn't matter.
255.
by danyork 12y ago
tqbf - this one is for you! :-)
256.
Is DNSSEC worth the effort?(iis.se)
1 points by danyork 12y ago|3 comments
257.
“What's in a Name?” Using DNSSEC/DANE for Authentication of Internet Services(blogs.verisigninc.com)
1 points by danyork 12y ago|0 comments
258.
by danyork 12y ago
> The cause was an internal DNS error at Apple Anyone know anything more? (Just curious)
259.
Apple: “DNS error” responsible for ongoing iTunes, App Store outages(cnbc.com)
4 points by danyork 12y ago|2 comments
260.
by danyork 12y ago
Thomas, I definitely defer to AGL when it comes to browser technology - and I've certainly read his "Not DANE" piece, but you'll note he did not entirely rule it out. He just said it may be "a long way out".
261.
by danyork 12y ago
Just to be clear: > DNSSEC/DANE replaces domain validated certificates. DNSSEC/DANE can be used to replace CA-issued certs, but it can also be used to add an extra layer of validation to existing CA-issued certs. To me t
262.
by danyork 12y ago
> What's the point of validating the communication between the servers if the last mile is unprotected? It's all incremental ways of reducing the attack surface. Get DNSSEC validation happening at large public DNS services..
263.
by danyork 12y ago
Not conceding anything... just pointing out some of the use cases today that are interesting. Another one is most of the email service providers in Germany, where DNSSEC / DANE are being seen as ways to have a more secure email envir
264.
by danyork 12y ago
And actually... > And actually, in case of the latter, all bets are off anyways. Because client resolvers DO NOT CHECK DNSSEC. ... please visit APNIC's DNSSEC Statistics site where you will see that about 12% of all DNS queries gl
265.
by danyork 12y ago
> Step 2: Return to drawing board > Step 3: Wait for better solution to emerge I, and I suspect many others, eagerly await the better solution to the DNS security issues we see. If you have one (beyond "do nothing"), pl
266.
by danyork 12y ago
So what is your alternative for solving DNS poisoning ?
267.
by danyork 12y ago
> Agreed that there is a lot of scope for doing better on BGP security, though Yes... and there we go down the path toward BPGSEC, RPKI and other tools that people are developing to help secure the routing infrastructure.
268.
by danyork 12y ago
> I'm sorry, but I'm going to have to point out that your comment doesn't respond to mine in any way. Hmmm... you said " you need to have a ready response to the extremely obvious observation that the Internet seem
269.
by danyork 12y ago
> I agree that we need a DNS privacy solution, one that hopefully doesn't eliminate the existence of caching infrastructure. Please do take a look at what the folks are doing within the DPRIVE working group of the IETF: https:&#x
270.
by danyork 12y ago
Thomas, as you are well aware, the Internet of 1994 was an extremely different and much smaller world. I completely agree with this: > It already needs the best security it can possibly get. It's just that I believe that DNSSEC

More ›