alt Hacker NewsDNSSEC is the weakest link here.
It is too fragile (multiple point of failure). It is high volume (=it need be cacheable).
Puting authentication cert in dns sounds good in theory, but we have never get that reliability
Replies
Hizonner • today at 1:12 AM
> It is too fragile (multiple point of failure).
If your DNS isn't working, you're not going to be making connections anyway. And if you can't keep DNSSEC running, you can't keep certs up to date either. DNSSEC is actually much simpler, with fewer failure points, once you set it up.
> It is high volume (=it need be cacheable).
It is. Unlike certificates. And the cache lifetimes are much shorter than typical certificate lifetimes.
➕ show 1 reply
Even without DNSSEC, the CAA record approach can help, as it requires MITMing between the CA and the DNS server, which may be harder in some cases than just MITMing a target site.
There’s some upcoming attempts at transport security for authoritative DNS servers which might help too: https://datatracker.ietf.org/doc/html/draft-hoffman-deleg-se...