Timeline for Is it possible to make HTTPS 0-RTT with help from DNS?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 30, 2018 at 15:00 | history | tweeted | twitter.com/StackSecurity/status/1057286246815461377 | ||
| Oct 30, 2018 at 9:13 | vote | accept | Cyker | ||
| Oct 30, 2018 at 4:35 | comment | added | Cyker | @dave_thompson_085 If I understand it correctly OCSP stapling is the server attaching a cert validity information. It can post that to DNS record regularly as well, so I don't think this is a problem. With DNSSEC and DoT (already supported by some public DNS providers), DNS is encrypted and authenticated. The only problem might be caching. But I always see this as a source of problems. (Try google why dns cache and it shows why clean/flush dns cache.) I definitely think we need more promptly updated DNS especially when it becomes more than a domain name resolver (eg: a certificate agent). | |
| Oct 30, 2018 at 3:54 | comment | added | dave_thompson_085 | Until DNSSEC actually works DNS can be tampered, but that's already true of IP. Also in practice DNS will often be cached for hours or days, meaning fixing any problem will be slowed quite a bit; in particular OCSP stapling probably can't work through DNS, so clients must either go back to basic OCSP or CRL, which were unreliable and slow, or to not checking revocation at all and allowing fraudulent or compromised sites to continue operating until the next browser or OS update. | |
| Oct 29, 2018 at 13:22 | answer | added | Steffen Ullrich | timeline score: 4 | |
| Oct 29, 2018 at 13:02 | history | asked | Cyker | CC BY-SA 4.0 |