Re: [xmpp] I-D Action: draft-miller-xmpp-dnssec-prooftype-03.txt

[Florian Jensen <[e-mail]>]

On 13 Feb 2013, at 14:50, Philipp Hancke <[e-mail]> wrote:

>> I've been chatting with Florian about this the two standards for proving ownership in the case of a delegating domain hosting.
>> Some background: Florian hosts many XMPP domains and at buddycloud, we're putting plans in place to host XMPP domains. In both cases, the more we have to ask customers to configure on their end, the less chance there is of a successful deployment.
>> Right now this is:
>> a) customer edits their DNS and point it at our servers. Nothing else.
> 
> No security at all, right? (other than server dialback)

Well, how often don't you trust your DNS ... It's pretty reliable.

> 
>> I have huge concerns about expecting customers to provide proofs at the web layer. Especially something that runs on their "main" website. Some reasons off the top of my head:
>> a) Messaging team is different to web team - slow or no deployment.
>> b) no website hosted on their domain - do we now host web stuff too?
> 
> Well, then the POSH proof type (or an equivalent integrated into draft-daboo-aggregated-service-discovery) can not be used by another xmpp server to discover the certificate for that domain.

Correct.

> 
>> c) their website is created or hosted by their marketing agency / some other less technical. A simple website push could overwrite their .well-known record could kill their messaging service.
> 
> hosting providers will have to protect .well-known.

So, in our case, we don't always host the Web service. Same for Google. Heck, we host quite a few domains who don't use HTTP at all.

> 
>> d) it's complicated.
>> DNSSEC is being rolled out. Sure some registrar and TLDs will take longer to deploy, but in the long term, I think this is the right way to have customers (especially non-technical customers who would rather delegate hosting) delegate their hosting.
> 
> Then deploy DNSSEC. Smart servers will (might) try that first and gradually fall back to POSH (or equivalent) and may resort to dial-back as a "who cares about security as long as it works" method.