Re:HTTPS Everywhere? This Email Service Gives You DANE, Too
by itistoday2 on Monday October 20, 2014 @06:39PM
(#8484930)
Yep. Note also that DANE (as they mention) currently depends on the full-blown DNSSEC stack to be useful. However, the full-blown DNSSEC stack suffers from many technical and design-related problems:
Disclaimer: I work on DNSChain, a blockchain-based alternative to DNSSEC & X.509. Note that DNSChain does support blockchain-authenticated DANE TLSA records. In the future, DNSSEC's SIG record may be used to provide MITM-proof verification of the validity of that TLSA record for DNS-based apps.
http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...
http://ianix.com/pub/dnssec-outages.html
Disclaimer: I work on DNSChain, a blockchain-based alternative to DNSSEC & X.509. Note that DNSChain does support blockchain-authenticated DANE TLSA records. In the future, DNSSEC's SIG record may be used to provide MITM-proof verification of the validity of that TLSA record for DNS-based apps.