51–60 of 104 posts
Is there a TL;DR version of how adding SSL will make it a whole lot better? Sorry to be dumb on this subject but my understanding of how email works (in particular SMTP) seems like the whole model is busted to begin with. Are we still sending basically plain text unsigned messages using something akin to the pony express? Does it matter that the pony express carriers communicates securely so no bad guys can snoop the…
Earlier quoted context omitted.
DNSSEC however has its own problems. I have been thinking of a DNSSEC2 proposal for a while now that for example would use online signing only.
Having no support for offline signing in and of itself isn't a selling point. What else does your approach have to offer?
Successful deployment of STS would bring to zero the number of real-world use cases for DNSSEC/DANE, which would be a very good thing.
Give me a solid anchor and a lever that is long enough and I can move the earth.
The problem of all modern crypto technos is 1) CPU burnt for crypto is a nice lever for DOS (and not all our mails require crypto, seriously 60% is spam) 2) they do not solve the 2 general problem
Yes 2 auth/Channels factors seems nice. The problem they stay on the same plane. It is 2 inbound channels.
You know when USA engineers last thought it was smart, kiddies learnt to use a 1$ cpt crunch whistle to phone for free all around the world.
Actually I don't mind, I am broke and totally will love free whatever the stuff that this kind of engineering will offer me.
Can't we pretty much please make it reasonably generic and not SMTP-specific? There are a lot of protocols (say XMPP, IRC or IMAP) around that have opportunistic encryption with STARTTLS-like semantics. Surely, they could all benefit from a similar solution.
Earlier quoted context omitted.
> encouraging to see Google, Microsoft, Yahoo and Comcast For all intents and purposes this is most of the English speaking internet. If you swap Yahoo for Verizon and Apple you'd be pretty close. So, yeah encouraging to get this standard applied, less so if you think it is good for the internet to offload an outsize share of control to 5-10 corporations.
>swap Yahoo for Verizon and Apple I think you underestimate how much email Yahoo (still) handles. Maybe add Apple to the list, but Verizon is nowhere near the volume / user count of Yahoo.
Earlier quoted context omitted.
Because the only remaining reason to deploy DNSSEC is to exploit DANE to allow SMTP MTAs to force TLS. All the other uses of DNSSEC are already DOA. It's a little tricky to explain why this is the case without getting into a lot of gritty detail. A shorthand answer is that browser vendors have, pretty much as a group, decided not to adopt DANE (the DNSSEC-based alternative to the X.509 CA system), and DANE is the onl…
Is SSHFP not a legitimate use case for DNSSEC? (Genuinely curious.)
Can't we pretty much please make it reasonably generic and not SMTP-specific? There are a lot of protocols (say XMPP, IRC or IMAP) around that have opportunistic encryption with STARTTLS-like semantics. Surely, they could all benefit from a similar solution.
IRCS has settled on 6697: https://tools.ietf.org/html/rfc7194
IMAPS uses 993.
Earlier quoted context omitted.
Because the only remaining reason to deploy DNSSEC is to exploit DANE to allow SMTP MTAs to force TLS. All the other uses of DNSSEC are already DOA. It's a little tricky to explain why this is the case without getting into a lot of gritty detail. A shorthand answer is that browser vendors have, pretty much as a group, decided not to adopt DANE (the DNSSEC-based alternative to the X.509 CA system), and DANE is the onl…
Is SSHFP not a legitimate use case for DNSSEC? (Genuinely curious.)
You don't need a secure DNS for the web.
You don't, with STS deployed, need a secure DNS for email.
Is publishing SSH key fingerprints so important that we should do a forklift upgrade of the DNS? No, of course not.
Earlier quoted context omitted.
Having no support for offline signing in and of itself isn't a selling point. What else does your approach have to offer?
It is a selling point in that it simplifies the protocol, making it easier to implement. Obviously it would not be the only difference.
In the current protocol the only difference between offline and online signing is in how authoritative servers are implemented. There the differences aren't all that significant (relative to building an authoritative server as a whole) -- the same data needs signing, etc -- so please explain how your protocol makes implementation simpler.
> Obviously it would not be the only difference.
Can you please expand on that? You've said you've been thinking of a DNSSEC2 proposal for a while so you must have more to say.
Earlier quoted context omitted.
It is a selling point in that it simplifies the protocol, making it easier to implement. Obviously it would not be the only difference.
> It is a selling point in that it simplifies the protocol, making it easier to implement. In the current protocol the only difference between offline and online signing is in how authoritative servers are implemented. There the differences aren't all that significant (relative to building an authoritative server as a whole) -- the same data needs signing, etc -- so please explain how your protocol makes implementati…