RE: DNSSEC indicator

Aren't we a bit unfair comparing the failures of past PKI CA infra with
a still upcoming DNSSEC infra?

My understanding is that DNSSEC is facing similar issues that PKI CA had
many years ago regarding root keys ownership.  Only time will say
whether deployed DNSSEC will have market acceptance and end-user
confidence thereof.

http://www.upi.com/Security_Terrorism/Analysis/2007/04/12/analysis_ownin
g_the_keys_to_the_internet/


-----Original Message-----
From: public-wsc-wg-request@w3.org [mailto:public-wsc-wg-request@w3.org]
On Behalf Of Dan Schutzer
Sent: den 26 april 2007 12:52
To: 'Dick Hardt'
Cc: 'Thomas Roessler'; michael.mccormick@wellsfargo.com; ses@ll.mit.edu;
public-wsc-wg@w3.org; kjell.rydjer@swedbank.se; steve@shinkuro.com;
public-usable-authentication@w3.org; 'Ben Laurie'
Subject: RE: DNSSEC indicator


I agree. So, DNSSEC provides me both a secure link and greater
confidence that I am speaking to the correct domain name

-----Original Message-----
From: public-usable-authentication-request@w3.org
[mailto:public-usable-authentication-request@w3.org] On Behalf Of Dick
Hardt
Sent: Thursday, April 26, 2007 6:19 AM
To: Dan Schutzer
Cc: Thomas Roessler; michael.mccormick@wellsfargo.com; ses@ll.mit.edu;
public-wsc-wg@w3.org; kjell.rydjer@swedbank.se; steve@shinkuro.com;
public-usable-authentication@w3.org; Ben Laurie
Subject: Re: DNSSEC indicator


fwiw I have always envisioned the significant impact of DNSSEC was to
provide a "trusted" method for tying the public key used in TLS to the
domain name bypassing the "leaky" CA infrastructure.

-- Dick

On 26-Apr-07, at 12:03 PM, Dan Schutzer wrote:

>
> Here is my take
>
> If they got the mapping from the domain name to the IP address 
> securely, it indicates that they are at the correct web site (the site

> belonging to the url they typed in), so if they send sensitive 
> information to the site, it is going to the correct site. However, if 
> the connection is not secured, then the information can be intercepted

> by a man in the middle attack.
> However,
> if the link is TLS secured, then the information cannot be intercepted

> in transit. To be confident one's personal information is not being 
> stolen, one would need to look at both indicators.
>
> -----Original Message-----
> From: public-usable-authentication-request@w3.org
> [mailto:public-usable-authentication-request@w3.org] On Behalf Of 
> Thomas Roessler
> Sent: Thursday, April 26, 2007 5:35 AM
> To: michael.mccormick@wellsfargo.com
> Cc: ses@ll.mit.edu; public-wsc-wg@w3.org; kjell.rydjer@swedbank.se; 
> steve@shinkuro.com; public-usable-authentication@w3.org
> Subject: Re: DNSSEC indicator
>
>
> (CC to the public comment list, since some folks who aren't on the
> WG are copied on this conversation.)
>
> On 2007-04-13 13:33:25 -0500, michael.mccormick@wellsfargo.com wrote:
>
>> I still think DNSSEC will be more valuable if it's visible to the
>> end user.  True, most won't care.  But some will, especially if
>> it can be presented in an intuitive and jargon-free fashion in
>> the UI.
>
> So, a user encounters a DNSSEC indicator.  That means that they got
> the mapping from the domain name to the IP address securely.  It
> doesn't tell them *anything* about the security of the conversation
> that goes on on higher protocol levels.
>
> On the other hand, if TLS is in place, the security of the
> connection doesn't really depend on DNSSEC, so the presence or
> absence of that indicator wouldn't provide any particularly useful
> information.
>
> Maybe one of you guys could enlighten me what user decision such an
> indicator would reasonably support?
>
> Thanks,
> -- 
> Thomas Roessler, W3C  <tlr@w3.org>
>
>
>
>
>

Received on Thursday, 26 April 2007 11:55:08 UTC