News for hackers. Stuff that matters.

A comment on Around 293 intermediate CAs in violation of CA/Browser guidelines. Parent comment

Re:Around 293 intermediate CAs in violation of CA/Browser gu... by tptacek on Tuesday July 07, 2020 @11:55AM (#23760489)
The bigger problem is that none of the browsers support it, or intend to support it. DoH could change that (ironically, the DNSSEC crowd opposes the one DNS change that could offer any chance of viability for DNSSEC), but it's unlikely to.
[ Parent | on HN ]
Re:Around 293 intermediate CAs in violation of CA/Browser gu... by _-___________-_ on Wednesday July 08, 2020 @04:33AM (#23768025)
Well, if the system resolver is doing DNSSEC validation, the browser doesn't need to support it. That's how I've had my system set up for years. Unfortunately, macOS and Windows (other than Server) still don't have any DNSSEC support as far as I'm aware. Support is built in to systemd-resolved now though, which I believe is the default resolver on various Linuxes, and unbound is of course available in all major distros.
[ Parent | on HN ]
Re:Around 293 intermediate CAs in violation of CA/Browser gu... by tptacek on Wednesday July 08, 2020 @11:11AM (#23770649)
If the goal is to have DNSSEC replace the CAs, then you need DANE, and for DANE to work, browsers have to support it.
[ Parent | on HN ]
Re:Around 293 intermediate CAs in violation of CA/Browser gu... by _-___________-_ on Friday July 10, 2020 @02:51AM (#23788884)
That can indeed be a goal, but DNSSEC is useful even without DANE.
[ Parent | on HN ]
Re:Around 293 intermediate CAs in violation of CA/Browser gu... by tptacek on Saturday July 11, 2020 @11:53AM (#23803075)
(a) No it can't be, and (b) that's not what this thread was about.
[ Parent | on HN ]