Skip to content

Comment on Why not DANE in browsersparent

Comments

While adoption of DNSCurve would of course be wonderful for privacy online, it cannot be used right now to provide DNS record authentication. The root and TLD nameservers would need to enable support for it, otherwise you'll always be able to MITM the upstream NS record response and redirect all further queries to your own server. Given the politics involved in DNSSEC, and the current anti-crypto climate, I'd say the chances of a fully-chained DNScurve deployment ever happening are about absolute zero.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.