Re:Universal DNSSEC: Secure DNS for Every Domain
by magila on Tuesday November 10, 2015 @12:30PM
(#10540755)
Key pinning is not a panacea either, it just makes browser/OS vendors another authority to be compromised and subverted.
While a healthy dose of cynicism is appropriate with-respect-to government control of TLDs, in the western world they are still at least nominally accountable to their constituents. Wholesale forgery is not likely to go over well with them, most importantly not with large tech companies. Targeted one-off forgeries would be easier to get away with, but they are also still perfectly doable today.
Re:Universal DNSSEC: Secure DNS for Every Domain
by tptacek on Tuesday November 10, 2015 @12:38PM
(#10540824)
That's a hand-waving argument. It basically says there's not much point in being concerned about communications security because someone who owns up your endpoint can bypass it anyways.
While a healthy dose of cynicism is appropriate with-respect-to government control of TLDs, in the western world they are still at least nominally accountable to their constituents. Wholesale forgery is not likely to go over well with them, most importantly not with large tech companies. Targeted one-off forgeries would be easier to get away with, but they are also still perfectly doable today.