News for hackers. Stuff that matters.

A comment on SMTP MTA Strict Transport Security (MTA-STS). Parent comment

Re:SMTP MTA Strict Transport Security (MTA-STS) by Sephr on Friday September 28, 2018 @06:16PM (#18097505)
Motivations are important, but your response does not address the technical issues brought up by the parent comment.

Initial discovery uses DNS, so wouldn't uncached hosts still be vulnerable to downgrade attacks without DNSSEC? MTA-STS seems to suffer from some of the same issues facing HPKP.

[ Parent | on HN ]
Re:SMTP MTA Strict Transport Security (MTA-STS) by tptacek on Friday September 28, 2018 @06:48PM (#18097684)
DNSSEC advocates also believe DANE is needed to address the weaknesses in things like HPKP and HSTS. Of course, nobody else does, no mainstream browser implements DANE, and at least two have attempted to support DANE and then withdrew that support.
[ Parent | on HN ]