From mboxrd@z Thu Jan 1 00:00:00 1970 From: erik quanstrom Date: Sat, 23 Jan 2010 20:01:15 -0500 To: 9fans@9fans.net Message-ID: <8094c7f53bad7b2e0bed09ec4bfd41dc@ladd.quanstro.net> In-Reply-To: References: <4B57048D.6040002@maht0x0r.net> <4f34febc1001231559s3ffb6037o2a193bf4689b961@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit Subject: Re: [9fans] Are we ready for DNSSEC ? Topicbox-Message-UUID: c5ac8a98-ead5-11e9-9d60-3106f5b1d025 > if the goal is avoiding ssl mitm attacks, > dns is the least of your worries. a mitm will > just take over the connection attempt for the > actual ip address. the solution there is > to implement proper ssl certificate chain checking. doesn't work with the recent renegotiation bug. it's a server attack, not a client attack. but i don't think one can dismiss dns as a non-issue. - erik