Re: [Cerowrt-devel] "DNSSEC considered harmful"

[Mikael Abrahamsson <swmike@swm.pp.se>]

On Thu, 8 May 2014, Maciej Soltysiak wrote:

> Hi,
>
> I read a twitter conversation last night where somebody said DNSSEC is
> harmful. I asked why and I got this littany of issues:
> http://ianix.com/pub/dnssec-outages.html
>
> I was blown away not only by the sheer evidence of outages, but especially
> by the quotes in last sections: Miscellaneous and What a mess.
>
> I don't know, have a look, I just wanted to share as I wasn't aware of
> things that didn't go well with DNSSEC. I'm not suggesting anything re
> Cerowrt here.

The failure mode of encrypted and authenticated communications is 
catastrophic failure (=nothing works). There are plenty people who says 
the "proceed anyway" option in modern browsers when the certificate 
failures occur, is wrong and the user shouldn't be allowed to continue.

This is why security is so hard, because secsurity protects against a 
potential and unknown attack, whereas when it doesn't work, you fail 
completely and the user just wants things to work so they'd rather turn 
security off and proceed anyway.

-- 
Mikael Abrahamsson    email: swmike@swm.pp.se