← Back to context

Comment by cyberax

3 days ago

DNSSEC is not dangerous. Pretty much the worst thing is breakage, not an accidental compromise.

It's also more secure, compared to ACME. An on-path attacker can impersonate the site operator and get credentials. DNSSEC is immune to that.

7 comments

cyberax

Reply
tptacek  3 days ago

This is a very strange definition of "dangerous".

  • cyberax  3 days ago

    I'm mostly thinking about dangerous from the security point of view. I agree that it might not be the best from the operational point of view. DNSSEC in its current state makes DNS updates even more risky than they are, I agree with that.