On Friday, May 3, 2013, Phillip Hallam-Baker wrote: > > > > On Fri, May 3, 2013 at 11:49 AM, Richard Barnes > <[email protected]<javascript:_e({}, 'cvml', '[email protected]');> > > wrote: > >> On Fri, May 3, 2013 at 8:15 AM, Leif Johansson >> <[email protected]<javascript:_e({}, 'cvml', '[email protected]');> >> > wrote: >> >>> On 05/03/2013 01:47 PM, Phillip Hallam-Baker wrote: >>> >>> +1 to the original post and Paul's. >>> >>> Putting per user data in the DNS is a lousy approach, it has never >>> been a succes because the DNS administrators are typically network admins >>> and they are a separate class to DNS admins. >>> >>> Hey, DNS is just a protocol. I don't think anybody is suggesting >>> running end-user data off of bind9 :-) >>> >>> The critical question is one of trust management: using webfinger >>> ties you to the "web pki" for all practical purposes. Using dane ties >>> you to the dnssec root. Personally I'd prefer more options. >>> >> >> Then use DANE to authenticate the HTTPS server in the WebFinger >> transaction.... >> > > If you are going to do that you might as well just use TLS for the SMTP > transaction, it would be much stronger. > > It is bad enough overloading the DNS to be a key centric PKI. The DNS is > at least a trusted infrastructure. But people who run Web servers do not > make security promises to the people who run the email server and your > proposal would make the security of their email hostage to the security of > the Web server. > > Web servers have active code crawling on them. They are connected up to > network file systems. They are 50 shades of yuk from a security point of > view. >
I know, good thing there's nothing security-critical on the web! </irony> > > -- > Website: http://hallambaker.com/ >
_______________________________________________ dane mailing list [email protected] https://www.ietf.org/mailman/listinfo/dane
