Re:Calling time on DNSSEC: The costs exceed the benefits
by tptacek on Saturday June 03, 2023 @03:17PM
(#36179661)
This is false! The point isn't that TLS 1.3 is a better protocol that DNSSEC (though: it extremely is). It's that the entire WebPKI ecosystem has features DNSSEC does not have, has no timeline towards having, and probably never will have, because DNSSEC is de jure controlled by sovereign countries who will not agree to a global transparency log.
[ Parent
| on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits
by belorn on Saturday June 03, 2023 @04:19PM
(#36180159)
I think you are missing the whole point of what is being suggested. There is no DNSSEC if clients are talking directly with authoritative services using DNS over TLS. No signatures, no sovereign countries who controls keys, not anything which is defined by the DNSSEC. Once a client is securely connect to an authoritative service using TLS, everything that the server is transmitting is by definition authenticated. The client need to traverse the tree of authoritative servers by itself, but that is the only drawback.