News for hackers. Stuff that matters.

A comment on Universal DNSSEC: Secure DNS for Every Domain. Parent comment

Re:Universal DNSSEC: Secure DNS for Every Domain by FiloSottile on Tuesday November 10, 2015 @10:08AM (#10539710)
> and does not cede to the US Government control over TLS keys

Hold on. This is actively conflating DNSSEC and DANE.

I know your point that the "main feature" of DNSSEC is enabling DANE, and I respect that. But the two domains are still distinct: DNS security and the PKI built on top of that.

DNSCrypt only addresses DNS security, so it should be compared to pure DNSSEC, which obviously does not "cede to the US Government control over TLS keys".

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @10:10AM (#10539717)
I don't agree with you. The top-down PKI DNSSEC expresses is inextricable from the DNS lookup security it attempts to provide. That DNSCrypt does a better job of solving lookup security without resorting to a government-controlled PKI is germane.
[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @10:10AM (#10539715)
Filo: How do you feel about pushing for enabling DNSCrypt on your DNS servers, and working with the folks at Mozilla to make sure Firefox supports it? ;)
[ Parent | on HN ]