On Fri, May 3, 2013 at 11:49 AM, Richard Barnes <[email protected]> wrote: > On Fri, May 3, 2013 at 8:15 AM, Leif Johansson <[email protected]> wrote: > >> On 05/03/2013 01:47 PM, Phillip Hallam-Baker wrote: >> >> +1 to the original post and Paul's. >> >> Putting per user data in the DNS is a lousy approach, it has never been >> a succes because the DNS administrators are typically network admins and >> they are a separate class to DNS admins. >> >> Hey, DNS is just a protocol. I don't think anybody is suggesting >> running end-user data off of bind9 :-) >> >> The critical question is one of trust management: using webfinger >> ties you to the "web pki" for all practical purposes. Using dane ties >> you to the dnssec root. Personally I'd prefer more options. >> > > Then use DANE to authenticate the HTTPS server in the WebFinger > transaction.... >
If you are going to do that you might as well just use TLS for the SMTP transaction, it would be much stronger. It is bad enough overloading the DNS to be a key centric PKI. The DNS is at least a trusted infrastructure. But people who run Web servers do not make security promises to the people who run the email server and your proposal would make the security of their email hostage to the security of the Web server. Web servers have active code crawling on them. They are connected up to network file systems. They are 50 shades of yuk from a security point of view. -- Website: http://hallambaker.com/
_______________________________________________ dane mailing list [email protected] https://www.ietf.org/mailman/listinfo/dane
