Tim W is a user on cantos.social. You can follow them or interact with them if you have an account anywhere in the fediverse.
@tw why do people still think DNSSEC has any tangible value. It’s garbage.
@tw unless every client device on the planet runs their own DNS recursor with DNSSEC validation it provides very little value in the real world
@tw I think it’s the wrong place in the stack to try to do authentication. Most DNS attacks are going to be against clients / browsers so as long as you’re using HTTPS you’re fine. The difficulty in forging TLS today is extremely high.
I much prefer dnscrypt which gives me a protected path to a recursor I can trust has strong security controls and monitoring for tampering / poisoning.
I much prefer dnscrypt which gives me a protected path to a recursor I can trust has strong security controls and monitoring for tampering / poisoning.
@tw kind of, but it doesn’t work that way in practice. The client using the recursor through dnscrypt still has to request DNSSEC records or they won’t be used and verified. So no good for most use cases, especially mobile clients.
@tw it’s not broken anymore with Certificate Transparency
