Point of DNSSEC?
Posted Apr 13, 2007 2:40 UTC (Fri) by ldo
In reply to: What to do about DNS?
Parent article: What to do about DNS?
Anyone who thinks that HTTPS or SSH magically gets the correct host key is blind to the obvious problem: Everyone accepts unknown keys, signing key distribution has to be performed manually by the web browser authors (which you must trust), key revocation remains largely unsolved, etc. ...
DNSSEC presents a much more promising approach ...
And how will DNSSEC succeed where SSL and SSH have not? People don't bother checking certificates or host key digests now, why will they check the authentications provided by DNSSEC? How will existing applications like FTP, SSH, host, ping, traceroute and so on present such authentications to the user?
If they block access to unauthenticated domains, that will simply annoy the user. If they let accesses through, then it's up to the user to check the authentication, and we've already seen that they can't be bothered. If you warn the user each time, then the sheer number of warnings will take its toll and lead to demands for the warnings to be turned off. And so you're right back to square one.
to post comments)