News for hackers. Stuff that matters.

A comment on For DNSSEC. Parent comment

Re:For DNSSEC by indolering on Thursday August 06, 2015 @04:35PM (#10019252)
There is nothing stopping you from doing online signing with DNSSEC. FWIW, DNSSEC is on it's third major iteration, 2/3rds of the TLDs have deployed it, and major DNS service providers are getting into the act.
[ Parent | on HN ]
Re:For DNSSEC by marcosdumay on Thursday August 06, 2015 @05:14PM (#10019497)
You can even avoid domain enumeration by doing online signing with DNSSEC. It's just that people still prefer the offline option.
[ Parent | on HN ]
Re:For DNSSEC by yuhong on Thursday August 06, 2015 @06:50PM (#10019947)
And the offline signing option adds complexity to the protocol.
[ Parent | on HN ]
Re:For DNSSEC by marcosdumay on Thursday August 06, 2015 @10:28PM (#10020670)
Ok, my point about people preferring the offline option wasn't criticism.

I'd it being the preferred option is strong evidence that the extra complexity is worth it.

[ Parent | on HN ]
Re:For DNSSEC by indolering on Thursday August 06, 2015 @08:24PM (#10020327)
So you are arguing to remove the offline signing capabilities?
[ Parent | on HN ]
Re:For DNSSEC by yuhong on Thursday August 06, 2015 @09:14PM (#10020448)
Yes.
[ Parent | on HN ]
Re:For DNSSEC by indolering on Thursday August 06, 2015 @09:42PM (#10020521)
That would force companies to either own all of the front-end server farms or store their keys on machines in untrustworthy environments.
[ Parent | on HN ]
Re:For DNSSEC by tptacek on Sunday August 09, 2015 @09:33PM (#10032256)
Yes: a choice between two very unattractive options. Isn't DNSSEC great?
[ Parent | on HN ]
Re:For DNSSEC by indolering on Tuesday August 11, 2015 @05:04PM (#10044381)
Uh? You can run everything in offline mode, unless you really care about trivial zone enumeration.
[ Parent | on HN ]
Re:For DNSSEC by yuhong on Thursday August 13, 2015 @02:29AM (#10052544)
I am not talking about the current DNSSEC, of course.
[ Parent | on HN ]
Re:For DNSSEC by Habbie on Tuesday August 11, 2015 @01:19PM (#10042754)
I.E. the way SSL/TLS is run today.
[ Parent | on HN ]