Why not DANE in browsers

https://www.imperialviolet.org/2015/01/17/notdane.html

by tptacek • 12 years ago

34 29 12 years ago

tptacek7• 12 years ago

The meatiest bit of this article, which is great:

Attackers control connectivity. Connectivity is expensive. Connectivity is also unreliable: captive portals, proxies, and firewalls break it. These factors make OCSP certificate revocation unworkable. For similar reasons, they make DANE's ostensible safeguard against malicious CAs unworkable. In practice, DANE would probably only be usable as an additional CA; it would not be able to effectively overrule any of the 1482 existing CAs.

Nimi• 12 years ago

Slightly off-topic: Could you please add RSS support to your "blog"? I'm sure others, besides me, would love to me notified of new entries. Thanks!

sarciszewski2• 12 years ago

Thomas: Would you agree that DNSSEC is a solution looking for a problem?

msturgill3• 12 years ago

There are a lot of real problems that DNSSEC can help solve.

However, it is important to note that DNSSEC and DANE are two different things. Much of the recent discussion here has lumped them together.

tptacek7• 12 years ago

What would those problems be?

tlb2• 12 years ago

The fact that TXT records don't work for some people shouldn't stop us. Anything that isn't currently widely used is broken for lots of people, because that's how networks are administered. Once it gets deployed and people start complaining, any specific network problem will get fixed.

Delaying proper network security because it won't currently work for a few percent of people seems like a recipe for never getting there.

tptacek7• 12 years ago

It's a cost-benefit issue. Do you believe DNSSEC is so valuable that it's worth (a) breaking connectivity for a significant number of people and (b) incurring the expense of replacing/upgrading the middleboxes that are breaking connectivity? If so, why?

tlb2• 12 years ago

I don't have a strong opinion on DNSSEC itself. It seems like it might be a good idea for email, at least.

I don't have much sympathy for network admins who block TXT records because it doesn't currently seem to break anything. TXT records are part of the spec, and if some of them have configured something to block them, that's not a good reason for everyone to not have secure systems.

tobias2014• 12 years ago

I'm using the browser plugin available at https://www.dnssec-validator.cz/ to validate dnssec/dane.

1019143• 12 years ago

I'm reading these blogged opinions on DNSSEC and DANE and I notice that they never state the problem(s) that these "solutions" are meant to address. At least not explicitly.

Somehow I doubt it, but if by chance there is only one true problem being addressed and that problem is simply how do we authenticate another computer as being who we believe her to be, then my second question is: what is wrong with SSH authentication?

tptacek7• 12 years ago

SSH authentication works fine.

cpach3• 12 years ago

It does. But as we all know that model can’t just be lifted over to WWW.

gsnedders• 12 years ago

what is wrong with SSH authentication?

You need some secure, out-of-band, communication means to transfer the key fingerprint to be able to verify it. The whole aim of the CA structure is so I don't need to somehow find a secure means to contact Amazon to verify their key fingerprint prior to first connecting to their website.

1019143• 12 years ago

What if I do not want to transfer the key over an insecure network of computer networks that are trivial to tamper with?

What if I would prefer to look up or obtain the key via some other means (that I deem more trustworthy that the internet)?

Why not DANE in browsers

Related Stories