News for hackers. Stuff that matters.

A comment on Calling time on DNSSEC: The costs exceed the benefits. Parent comment

Re:Calling time on DNSSEC: The costs exceed the benefits by cyberax on Saturday June 03, 2023 @04:04PM (#36180038)
How would that work if you only trust DANE? And if you have a control over a CA, then you can just issue yourself a certificate for any host anyway, so it's a moot point.
[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by tptacek on Saturday June 03, 2023 @04:06PM (#36180042)
https://blog.apnic.net/2021/08/31/tls-with-dane/
[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by cyberax on Saturday June 03, 2023 @04:23PM (#36180194)
Uhm. It doesn't contradict anything I said. If you MITM the session and strip the DANE data, then you'll be left with no trust anchors.

You can do the same with the regular CA-based trust chain.

[ Parent | on HN ]