Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by IshKebab | Hacker News Reader

Parent Full thread

IshKebab·

I really hope letsencrypt doesn't delay the real solution - DANE.

View on HN

I was not familiar with DANE:

https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

Until the CA system is completely abolished, this appears to works great with LE -- free certificates and a guarantee that no other CA can impersonate you.

The ACME protocol could conceivably be extended to update SRV records along with the certificate for some DNS providers.

It's not a good solution.

https://www.imperialviolet.org/2015/01/17/notdane.html

The TL;DR of that is:

1. DNSSEC uses a lot of 1024-bit RSA signatures (those are relatively weak) 2. You can't monitor the certificates that CA's issue because anyone issue their own certificates.

The first issue seems valid, but fixable. The second is a weird thing to complain about because it is the entire point of DANE!

Fixable but very unlikely to be fixed anytime sone. Plus the tons of technical issues that make it even more of a problem to use and maintain. To make it viable it would probably have to start over.

I'm not holding my breath.

DANE certainly is not the real solution. The solution is to deploy HPKP and require CT in the future.

HPKP is entirely complementary to DANE.

Remedial question, for the unfamiliar folks: how do I establish a bootstrap trust w/DNSSEC? Does it require backwards-incompatible changes at the root?

The short story is that it's part of the root now, which is something resolvers ship with.

Reply on news.ycombinator.com