OK, I hadn't read that post before. Some of the arguments you had already made but some I hadn't read before.

But I mean, it doesn't bode well when even the first paragraph is incorrect:

> All secure crypto on the Internet assumes that the DNS lookup from names to IP addresses are insecure. Securing those DNS lookups therefore enables no meaningful security.

This is incorrect because if an attacker can make a DNS lookup (say for example.com) resolve to an attacker-controlled entry (and there are multiple ways to do this), the attacker can trick almost all CAs into signing a certificate for example.com, which the attacker can use to perform a MITM attack against example.com.

So WebPKI fails to protect against insecure DNS.

> DNSSEC is a Government-Controlled PKI

This is the same "moving the goal posts" argument. The government already controls the domain system, so you wouldn't be any worse with DNSSEC and DANE than with insecure DNS and WebPKI. You'd actually be much more secure.

I mean, sure, if you want to propose a security system that has all the benefits of DNSSEC and also subverts the government, feel free to do so (and good luck with that).

> In a world where users rely on DANE, those governments have much of the same cryptographic authority as the CAs do now

Governments would have the same authority as today. Nothing would change with that. I'm not sure why you think DNSSEC has to subvert the government when neither insecure DNS nor WebPKI does that.

In fact, insecure DNS and WebPKI allow a lot more attacks from governments, as any government can attack any website in the entire world.

> Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY’s TLS keys.

Muammar Gaddafi could have controlled BIT.LY's TLS keys with the WebPKI system, if he wanted!

Or do you think insecure DNS and the WebPKI system protects against a government hijacking a domain? It doesn't, at all! Governments routinely hijack/seize (and block) domains with the current system.

> DNSSEC is Cryptographically Weak

> A modern PKI would almost certainly be based on modern elliptic curve signature schemes,

As far as I know DNSSEC supports elliptic curves.

> But the code that handles lookups today is buried deep in the lowest levels of application network code, and is rarely if ever wired for user interface.

Browsers can definitely have such a UI, they already have their own DNS caching mechanisms and whatnot. And other applications already have the same problem with TLS, this is no different with DNSSEC.

> DNSSEC is harder to deploy than TLS.

Yeah, I'm not sure about that. Like you said before, DNSSEC was automatically enabled by registrars in Europe for millions of customers, without them doing anything.

And even when it's not automatically enabled, usually you just have to tick a box in your DNS provider and/or copy a key into your registrar.

Sure, more complicated deployments are possible but the same is true for TLS.

In fact, even the most basic TLS deployment requires significantly more steps than enabling DNSSEC.

> In fact, it does nothing for any of the “last mile” of DNS lookups: the link between software and DNS servers. It’s a server-to-server protocol.

It does if the last mile is DNS-over-HTTPS, or DNS-over-TLS, or the client does DNSSEC validation.

> Even if DNSSEC was deployed universally and every zone on the Internet was signed, a coffee-shop attacker would still be able to use DNS to man-in-the-middle browsers.

No, nowadays this wouldn't be a realistic scenario anymore.

Clients should do DNS-over-HTTPS and/or DNS-over-TLS and/or DNSSEC validation.

> DNSSEC is Unsafe

It's not, you mentioned NSEC3 yourself below, while dismissing it as "bizarro", which I don't see how it can be a valid argument.

> DNSSEC is Architecturally Unsound

> effective security is almost invariably application-level and receives no real support from the network itself.

Right, because applications do so much to enforce DNS security and handle DNS hijacks nowadays.

If DNSSEC was enabled by default then applications wouldn't have to worry about DNS security and they would be just fine.

But those that wanted it, could still handle it differently (like browsers). For example, by having a DANE version of openssl which would give them more information about failures.

> How could US government IT not love it?

Oh, why don't you ask that about the WebPKI? That's a government's dream come true, actually.

With WebPKI, countries like Russia / China / Ethiopia / Somalia / Whatever can perform MITM attacks on .COM domains. Or whatever TLD they want.

With DNSSEC and DANE they can't.

> If you’re running systems carefully today, no security problem you have gets solved by deploying DNSSEC.

Yes, because everyone is running systems so carefully today.

And if no security problem gets solved by deploying DNSSEC, will you let me MITM your DNS server and we'll see what happens?

Haven't CAs already demonstrated their incompetence, power abuse and inability to prevent governments from around the world from attacking domains in other countries?

I really mean no offense or disrespect, but this post honestly just reads like a bunch of FUD to me...