[Cerowrt-devel] "DNSSEC considered harmful"
swmike at swm.pp.se
Fri May 9 04:38:43 EDT 2014
On Thu, 8 May 2014, Maciej Soltysiak wrote:
> I read a twitter conversation last night where somebody said DNSSEC is
> harmful. I asked why and I got this littany of issues:
> I was blown away not only by the sheer evidence of outages, but especially
> by the quotes in last sections: Miscellaneous and What a mess.
> I don't know, have a look, I just wanted to share as I wasn't aware of
> things that didn't go well with DNSSEC. I'm not suggesting anything re
> Cerowrt here.
The failure mode of encrypted and authenticated communications is
catastrophic failure (=nothing works). There are plenty people who says
the "proceed anyway" option in modern browsers when the certificate
failures occur, is wrong and the user shouldn't be allowed to continue.
This is why security is so hard, because secsurity protects against a
potential and unknown attack, whereas when it doesn't work, you fail
completely and the user just wants things to work so they'd rather turn
security off and proceed anyway.
Mikael Abrahamsson email: swmike at swm.pp.se
More information about the Cerowrt-devel