Subject: [dane] Google Chromium team closes DNSSEC/DANE as a WontFix

From: Dan York <[email-masked]>
Date: Thu, 2 Oct 2014 12:09:05 +0000

It seems we may not be seeing DANE / DNSSEC support in Google Chrome anytime soon. This ticket was just closed as a WontFix:

https://code.google.com/p/chromium/issues/detail?id=50874#c22

As the ticket says (in part):
-----
Closing this out as WontFix, as there are no plans.
<snip>
DNSSEC and DANE (types 2/3) do not measurably raise the bar for security compared to alternatives, and can be negative for security.
DNSSEC+DANE (types 0/1) can be accomplished via HTTP Public Key Pinning to the same effect, and with a much more reliable and consistent delivery mechanism.

While not desiring to stifle discussion, we've continued to evaluate the security and usability benefits and costs of DNSSEC and DANE, and will continue to do so, but for now, this is neither something we plan to implement nor would support landing.
-----

Any thoughts?

Dan

---

From: Rene Bartsch <[email-masked]>
Date: Fri, 03 Oct 2014 11:47:17 +0200

Am 2014-10-02 14:09, schrieb Dan York:
> It seems we may not be seeing DANE / DNSSEC support in Google Chrome
> anytime soon. This ticket was just closed as a WontFix:
> 
> https://code.google.com/p/chromium/issues/detail?id=50874#c22 [1]
> 
> DNSSEC and DANE (types 2/3) do not measurably raise the bar for
> security compared to alternatives, and can be negative for security.
> DNSSEC+DANE (types 0/1) can be accomplished via HTTP Public Key
> Pinning to the same effect, and with a much more reliable and
> consistent delivery mechanism.
> 
> While not desiring to stifle discussion, we've continued to evaluate
> the security and usability benefits and costs of DNSSEC and DANE, and
> will continue to do so, but for now, this is neither something we plan
> to implement nor would support landing.
> -----
> 
> Any thoughts?
> 
> Dan

It seems Google wants to become the one and only authority by 
certificate pinning to control whose certificates are accepted instead 
of leaving the choice to the domain owner. This also obstructs the 
transition to free self-signed certificates for non-commercial domains. 
In my opinion the certificate should be linked to the domain by the 
domain infrastructure -> DNSSEC.

Please comment https://bugzilla.mozilla.org/show_bug.cgi?id=1077323 to 
encourage Mozilla to implement DANE. This would also improve security 
when downloading Firefox updates/addons.

-- 
Best regards,

Rene Bartsch, B. Sc. Informatics

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 3 Oct 2014 15:54:21 +0000

On Thu, Oct 02, 2014 at 12:09:05PM +0000, Dan York wrote:

> It seems we may not be seeing DANE / DNSSEC support in Google
> Chrome anytime soon. This ticket was just closed as a WontFix:
> 
> Any thoughts?

I'm not surprised with respect to HTTPS.

I'd however like to eventually see DANE support in the new
opportunistic security HTTP.  Perhaps a dialogue can be opened up
with the browser developer community to understand the pros and
cons and what it would take to make opportunistic DANE TLS with
HTTP2 a realistic option. (Is it all about the DNSSEC last mile?
Something else?)

-- 
	Viktor.

---

From: Nico Williams <[email-masked]>
Date: Fri, 3 Oct 2014 14:27:51 -0500

> I'm not surprised with respect to HTTPS.

But I am surprised at the contents.

> opportunistic security HTTP.  Perhaps a dialogue can be opened up

Yes, H2 creates a great new opportunity.

> HTTP2 a realistic option. (Is it all about the DNSSEC last mile?

+1

Nico
--