<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 4/25/2025 3:36 PM, Christian de
Larrinaga wrote:<br>
</div>
<blockquote type="cite" cite="mid:87y0voa733.fsf@firsthand.net">
<pre wrap="" class="moz-quote-pre">Shreyas Zare via cryptography <a class="moz-txt-link-rfc2396E" href="mailto:cryptography@metzdowd.com"><cryptography@metzdowd.com></a> writes:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">*That* is what certificates protect against. DNSSEC will not help
you at all because as long as you are connected to my hot spot, I
control the entire Internet from your point of view, not just DNS.
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
DNSSEC will help protect with DANE. Controlling a hot spot does not
make it vulnerable.
Its about time web browsers add support for DANE as an alternative
option for people who want to use it.
Regards,
*Shreyas Zare*
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
DNSSEC signing a zone to the root is needed first?
</pre>
</blockquote>
<p>Yes, that's the prerequisite to have the zone signed. Which is
much easier to do with some DNS providers which give you an ON/OFF
switch to sign your zone.<br>
</p>
<p><br>
</p>
<div class="moz-signature">
<p>
Regards,<br>
<b>Shreyas Zare</b><br>
<a href="https://technitium.com/">Technitium</a>
</p>
</div>
<div class="moz-cite-prefix"><br>
</div>
<p></p>
</body>
</html>