Hacker News Reader

There is nothing stopping you from doing online signing with DNSSEC. FWIW, DNSSEC is on it's third major iteration, 2/3rds of the TLDs have deployed it, and major DNS service providers are getting into the act.

View on HN

You can even avoid domain enumeration by doing online signing with DNSSEC. It's just that people still prefer the offline option.

And the offline signing option adds complexity to the protocol.

So you are arguing to remove the offline signing capabilities?

Yes.

That would force companies to either own all of the front-end server farms or store their keys on machines in untrustworthy environments.

Yes: a choice between two very unattractive options. Isn't DNSSEC great?

Uh? You can run everything in offline mode, unless you really care about trivial zone enumeration.

I am not talking about the current DNSSEC, of course.

I.E. the way SSL/TLS is run today.

Ok, my point about people preferring the offline option wasn't criticism.

I'd it being the preferred option is strong evidence that the extra complexity is worth it.

Reply on news.ycombinator.com