IETF Logo Mail Archive

Re: [dane] Two additions to draft-york-dane-deployment-observations-00

Paul Wouters <paul@nohats.ca> Mon, 10 November 2014 00:55 UTC

Return-Path: <paul@nohats.ca>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A90641A87C3 for <dane@ietfa.amsl.com>; Sun, 9 Nov 2014 16:55:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.594
X-Spam-Level:
X-Spam-Status: No, score=-2.594 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.594] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hnIHoh96b367 for <dane@ietfa.amsl.com>; Sun, 9 Nov 2014 16:55:09 -0800 (PST)
Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0AEE1A87E8 for <dane@ietf.org>; Sun, 9 Nov 2014 16:55:09 -0800 (PST)
Received: from bofh.nohats.ca (bofh.nohats.ca [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 95552817C1; Sun, 9 Nov 2014 19:55:08 -0500 (EST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1415580908; bh=6Q52/dKSclKEOajpxRGzK/mRMWULBMf3ufzrZUwITjA=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=vHFHgn23YPks019pRqpcNRlLX5vAFwq/3reKBdr/6RHJ3wLJU8AN8uhSTPDIlpG6Z cPgFrqrCBDXNUicTwpZ9JYw278tsmegDoqgY/tLykLW0qyY/HZr5oawXDc01dBySHE 3NKQPso2rPyvA1t2L3uK1Va3xa4hNqTJEZy7ivL8=
Received: from localhost (paul@localhost) by bofh.nohats.ca (8.14.7/8.14.7/Submit) with ESMTP id sAA0t8Ll010182; Sun, 9 Nov 2014 19:55:08 -0500
X-Authentication-Warning: bofh.nohats.ca: paul owned process doing -bs
Date: Sun, 09 Nov 2014 19:55:07 -0500
From: Paul Wouters <paul@nohats.ca>
To: Stephane Bortzmeyer <bortzmeyer@nic.fr>
In-Reply-To: <20141107232915.GA31913@laperouse.bortzmeyer.org>
Message-ID: <alpine.LFD.2.10.1411091953240.6225@bofh.nohats.ca>
References: <20141107232915.GA31913@laperouse.bortzmeyer.org>
User-Agent: Alpine 2.10 (LFD 1266 2009-07-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"; format="flowed"
Archived-At: http://mailarchive.ietf.org/arch/msg/dane/6CR_hL8qqYdsIipxg6vZ0nxBgwM
Cc: dane@ietf.org
Subject: Re: [dane] Two additions to draft-york-dane-deployment-observations-00
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Nov 2014 00:55:12 -0000

On Fri, 7 Nov 2014, Stephane Bortzmeyer wrote:

> The first one is that some people distrust the domain name industry
> and feel that it is not safe to exchange the CA for the domain name
> actors (some of them having bad reputations like G... D...). Now, we
> all know it is more complicated than that (usages PKIX-* do not
> required that you drop the CA system, but on the other hand, some
> people fear that, if DANE is in the browser, the registrar, registry
> or the DNS hoster may be able to divert your users to a false site,
> something they could not do before). I don't say that I follow this
> reasoning but I've heard it several times so it could be documented.

And for that, we bring you CT for DNSSEC. Go look at the presentation
and be ready to give us feedback this monday at TRANS :)

http://www.ietf.org/proceedings/91/slides/slides-91-trans-3.pdf

Paul

v2.23.0 | Report a Bug | By Email