dennisjackson - Network

https://last-chance-for-eidas.org/update-151123

https://last-chance-for-eidas.org/update-151123

@dangoodin https://last-chance-for-eidas.org/

@dangoodin https://last-chance-for-eidas.org/

@Bing_Chris https://last-chance-for-eidas.org/

@Bing_Chris https://last-chance-for-eidas.org/

https://last-chance-for-eidas.org/

https://last-chance-for-eidas.org/

Finally! 🥳 https://blog.mozilla.org/en/products/firefox/encrypted-hello/

Finally! 🥳

https://blog.mozilla.org/en/products/firefox/encrypted-hello/

@matt Just following up on your tweet (https://twitter.com/TheBlueMatt/status/1640976970199760896). I appreciate the passion and wanted to...

@matt

Just following up on your tweet (https://twitter.com/TheBlueMatt/status/1640976970199760896). I appreciate the passion and wanted to share a bit more of my opinion as an individual.

From where I sit, I'm much more positive about the impact of systems like Certificate Transparency where we can ensure that any CA MiTM is quickly detected, rather than adding an independent root of trust with DNSSEC.

As far as I know, DNSSEC signing keys are controlled by the TLD operators and its not like websites can migrate to a different TLD without losing their identity / reputation. Also, there's no transparency mechanism for what the TLD operators sign. They could easily swap out your HTTPS RR record. So building systems that place greater reliance on DNSSEC feels like an anti-pattern to me.

Lots of details to work out, but an exciting proposal! ---RT @bwesterbIf post-quantum signatures aren’t a drop-in replacement for...

Lots of details to work out, but an exciting proposal!
---
RT @bwesterb
If post-quantum signatures aren’t a drop-in replacement for certificates, then perhaps we should do certificates without signatures. https://www.ietf.org/id/draft-davidben-tls-merkle-tree-certs-00.html
https://twitter.com/bwesterb/status/1634348941968900096

This is my account on Twitter - twitter.com/dennis__jackson - verified by @twittodon https://Twittodon.com

This is my account on Twitter - twitter.com/dennis__jackson - verified by @twittodon https://Twittodon.com