Re:Calling time on DNSSEC: The costs exceed the benefits
by tptacek on Saturday June 03, 2023 @03:19PM
(#36179680)
The stapling extension for TLS is a dead letter. Work on it was abandoned a couple years ago, when it finally occurred to the working group that control of a CA would allow you to strip the stapled DANE proof off the handshake, which defeats the entire purpose of the extension. DANE advocates counterproposed a pinning mechanism and got laughed out of the discussion by the browsers, for whom "pinning" is a cursed word.
[ Parent
| on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits
by cyberax on Saturday June 03, 2023 @04:04PM
(#36180038)
How would that work if you only trust DANE? And if you have a control over a CA, then you can just issue yourself a certificate for any host anyway, so it's a moot point.
Re:Calling time on DNSSEC: The costs exceed the benefits
by cyberax on Saturday June 03, 2023 @04:23PM
(#36180194)
Uhm. It doesn't contradict anything I said. If you MITM the session and strip the DANE data, then you'll be left with no trust anchors.
You can do the same with the regular CA-based trust chain.