Re:SMTP MTA Strict Transport Security (MTA-STS)
by tialaramex on Friday September 28, 2018 @08:43PM
(#18098086)
Maybe time to update your rant about DNSSEC.
For example, when you're explaining about how DNSSEC isn't relevant to the Domain Validation problem, you could mention that er, it's checked by the CA which issued your certificate, and closes literally the only otherwise insecure link in the chain for that CA.
Sound implementations of 3.2.2.4.7 (including those by your own chosen CA) are protected by DNSSEC. No DNSSEC? No protection.
Further down you're going to want to cover how the thing you were so sure it was essential to protect (secret hostnames) is actually gone now in the very architecture you told everybody they should prefer over DNSSEC (the Web PKI). If you're polite you'd explain how this happened, all the trust breaches and security problems in your better option that meant we had no other choice.
Or you know, just keep linking to the 2015 version and acting as though nothing changed. Put it on your Friendster maybe?
For example, when you're explaining about how DNSSEC isn't relevant to the Domain Validation problem, you could mention that er, it's checked by the CA which issued your certificate, and closes literally the only otherwise insecure link in the chain for that CA.
Sound implementations of 3.2.2.4.7 (including those by your own chosen CA) are protected by DNSSEC. No DNSSEC? No protection.
Further down you're going to want to cover how the thing you were so sure it was essential to protect (secret hostnames) is actually gone now in the very architecture you told everybody they should prefer over DNSSEC (the Web PKI). If you're polite you'd explain how this happened, all the trust breaches and security problems in your better option that meant we had no other choice.
Or you know, just keep linking to the 2015 version and acting as though nothing changed. Put it on your Friendster maybe?