jdev - 2024-12-29

what do people of jdev think of DNSSEC and DANE being used to authenticate TLS client and servers without a CA

is that cool?

why not both ? but sure it's cool

DANE uses DNSSEC, i mean

you can't have one without the other

other than DNSSEC not being dependent on DANE

Certainly cool. Ideal, even

It's too easy to MITM without that

i'd absolutely like to be independent from CAs

Cynthia, sorry I mean why not DNSSEC+DANE *and* signed by a CA ? that's what I've been running for... probably a decade or more

moparisthebest: ah

well, CA signing is a bit of a pain in the ass

that way the things that support DANE don't care about the CA, and things that don't support DANE still trust my certs

CA signing is easy, thanks letsencrypt ! I just use acme.sh

hahaha

before letsencrypt

For sure both is still necessary for most services during the transition period

you had to pay money to get your cert signed

oh yea I remember the dark days please don't remind me

> For sure both is still necessary for most services during the transition period that's true

There were other free robot cas before letsencrypt

And there are others still now

ACME being standardized as a protocol for them all is nice though

Until we convince everyone to move to DANE

browsers still don't support DNSSEC+DANE

as far as XMPP goes all the .im domains are a real problem

Cynthia: browsers are a whole different security situation anyway

> as far as XMPP goes all the .im domains are a real problem There are several solutions to that. And if we get to the point where they are the only holdouts I will be very happy ✏ ↺

I agree with the last part, for the first part there aren't really solutions

Sure there are. Change to a different TLD. Fix the TLD. Run a shadow root for the TLD. For just some examples

Changing is the only "fix" under anyone here's control Fixing the TLD would of course be nice Running a DLV is silly as it'd be worse than the current CA system

Don't forget XMPP has 0 support for changing domains 🥲