Re: [openpgp] [dane] Storing public keys in DNS or LDAP, or elsewhere

["Rick van Rein (OpenFortress)" <[e-mail]>]

Hello,

>> The classic Internet protocol for providing per-user data is "finger",
>> RFC 742 from 1977.

Love it.  My first play with redundant/reliable hosting was "fingerhosting", which
achieved 99.9999% uptime due to tripple servers of 99% each :)

>> Finger has two drawbacks for this purpose: It is not authenticated nor
>> encrypted;

Yes, so it is purely there for public data.  For such data, it's better-positioned user data than DNS.

>> and it is designed to be human-readable, not
>> machine-readable.

That ought to be good for some degree of privacy ;-) but this is why so many attempts are made to structure data in DNS but why I prefer LDAP with its large set of predefined techniques and formats -- and it's openness for DIY specs that won't clash due to the use of ASN1 OIDs.

I wouldn't mind seeing http://user@domain/ step into this cavity BTW -- HTTP must be the only protocol on the planet (well, sort of) that does not support usernames, and we are using this pattern very, very often nowadays.

>  Given IPv6, putting a unique IP
> address per hosted domain isn't so terrible, but having
>        % finger [e-mail]

This would be an operational impossibility I fear.  If people need to get an IPv6 address per user to be able to run finger, then no admin will support it.  "Just use WebFinger", I can hear them say.

WebFinger by the way, is too far up the stack IMHO -- it queries the .well-known directory on a webserver, fills in a pattern and does a query.  Sounds more like DNS stuff to me, and a good application for http://user@domain/ -- the other obvious beneficiary being OpenID.  This might call for a SRV record of some kind in the DNS -- or an NAPTR.

> (yes, you can finger me for keys to check this message. John convinced me it
> the utility 15 years ago.)

Wonderful :)  If there were more like you it'd be the IPv6-added-value-showcase that could help the transport concur the World ;-)

-Rick