News for hackers. Stuff that matters.
Re:Stop Using Encrypted Email by alwillis on Thursday February 20, 2020 @11:16AM (#22376110)
Having cryptographically signed DNS records that can’t be forged and can be validated is good thing, which is what DNSSEC provides.

Right now, DANE is the only way to mitigate downgrade attacks with SMTP and TLS connections. Apparently use of DANE for email is growing [1].

DANE hasn’t taken off with browser vendors because of their concern about additional DNS lookups when making TLS connections.

[1]: “Number of DANE-enabled mail domains growing exponentially”—https://www.sidn.nl/en/news-and-blogs/number-of-dane-enabled...

Re:Stop Using Encrypted Email by tptacek on Thursday February 20, 2020 @11:28AM (#22376199)
If that were the case, browser vendors would have helped push the DNSSEC chain-extensions forward, which were designed exactly to avoid doing DNS lookups to carry DANE records. Instead, the browser vendors laughed at the chain-extensions effort, and it died in committee.