[148046] in cryptography@c2.net mail archive
Re: [Cryptography] DNSSEC = completely unnecessary?
daemon@ATHENA.MIT.EDU (Ben Laurie)
Wed Nov 6 13:58:41 2013
X-Original-To: cryptography@metzdowd.com
In-Reply-To: <alpine.LFD.2.10.1311052023070.31146@bofh.nohats.ca>
Date: Wed, 6 Nov 2013 15:52:18 +0000
From: Ben Laurie <ben@links.org>
To: Paul Wouters <paul@cypherpunks.ca>
Cc: Greg <greg@kinostudios.com>,
"cryptography@metzdowd.com List" <cryptography@metzdowd.com>
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com
On 6 November 2013 01:48, Paul Wouters <paul@cypherpunks.ca> wrote:
> That's a nonsense argument. Abuse of such powers, unlike the plethora of
> CA certs, would need to be world visible, that is untargetted. It would
> be very very visible. It is a huge win over CAcerts that can target
> individuals with specifically crafted signed certs.
>
> With dnssec, if the Government of Canada causes my nohats.ca to be
> modified (appear red on your above map), then my domain's public
> information changes. I would notice that. This is not an invisible
> MITM like some CA cert injection.
How did DNS get this magic un-MITM-able property?
Surely if the GoC wants to cause nohats.ca to be modified, for some
specific target(s), they can do that?
_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
