News for hackers. Stuff that matters.

A comment on We updated our RSA SSH host key. Parent comment

Re:We updated our RSA SSH host key by roblabla on Friday March 24, 2023 @06:37AM (#35287286)
DNS can trivially be mitm'd. DNS-stored fingerprints are strictly less secure than TOFU.
[ Parent | on HN ]
Re:We updated our RSA SSH host key by tialaramex on Friday March 24, 2023 @09:40AM (#35288923)
If you use DNSSEC (cue inevitable rant from Thomas) this just works. If you have DoH (and why wouldn't you?) and your trusted resolver uses DNSSEC (which popular ones do), you get the same benefits.

https://en.wikipedia.org/wiki/SSHFP_record

[ Parent | on HN ]