News for hackers. Stuff that matters.
Re:DNSSEC failures are how you get people to disable DNSSEC by mike_hearn on Friday June 02, 2023 @11:37AM (#36166592)
Catch 22. To know the server wants to exclusively use DANE you must learn that in a secure way, like via DNSSEC, but the point of DANE is to not do interactive DNSSEC queries.

I guess if you're publishing an intent to use DANE stapling exclusively via DNS, then you could have tools that crawl the CT logs looking for CA issuances for domains that claim they don't want them. Though maybe detecting an attack in that way isn't worth much.

Re:DNSSEC failures are how you get people to disable DNSSEC by tptacek on Friday June 02, 2023 @11:54AM (#36166798)
There was talk of them proposing a pinning mechanism, but for understandable reasons the browser vendors were having none of it.