Re: [dane] Behavior in the face of no answer?

[Paul Wouters <[e-mail]>]

On Fri, 4 May 2012, Nicholas Weaver wrote:

> This is why browser's have given up on the other solution for the bad CA problem: Certificate Revocation Lists.  Because an attacker can block the CRL check, and the CRL check is NOT mandatory (they are unreliable enough that its not treated as a hard fail), CRLs are useless for blocking attackers.

But CRLs are cached, so once you got it from a working connection, it
does offer some protection once you move into a hostile network and
you already have the cached CRL of the cert they try to use on you.

> DNSSEC at all requires client validation, and client validation REQUIRES that the client be able to bypass the significant-probability-broken recursive resolver already.  DANE doesn't really add to that:  If the client can fetch DNSSEC signed records, TLSA won't be a problem.

Unless specifically targetted and filtered (or not understood)

Paul