Re:Why not DANE in browsers
by tptacek on Sunday January 18, 2015 @06:20PM
(#8909412)
If traffic is end-to-end protected with cryptography --- as, for instance, it is in the SSH protocol --- why does it matter if DNS records are authenticated? If you forge a DNS record, the SSH protocol will kill the session. SSH doesn't even need to care what the DNS says; all that matters are the cryptographic secrets.
[ Parent
| on HN ]
Re:Why not DANE in browsers
by sarciszewski on Sunday January 18, 2015 @06:34PM
(#8909453)
I'm going to be generous here and assume they meant authenticated encryption rather than just encryption between the user and the first DNS server they hit.
Which, given how DNSCurve was designed, is a non sequitur :)