Re: PKA support

Klaus Ethgen <[email protected]> Fri, 10 Apr 2026 16:20:39 +0100
Newsgroups	gmane.comp.encryption.gpg.user
Message-ID	<[email protected]>
Am Fr den 10. Apr 2026 um 15:23 schrieb Jakob Bohm via Gnupg-users:
> On 10/04/2026 09:41, Klaus Ethgen wrote:
> > Hi,
> >
> > Am Fr den 10. Apr 2026 um  8:28 schrieb Werner Koch:
> >> And: DNS is not more secure given all the problems and the move from DNS
> >> to HTTPS based DNS lookup in the browsers.
> > Well, if you do DNSSEC, it is much more secure than HTTPS. However, the
> > problem is, that major players do not care about implementing it. For
> > example, Hetzner does still not allow to add DNSSEC glue to the
> > registration. There was a solution for this but isc closed it down as
> > "all country toplevel domains support DNSSEC", fully ignoring that the
> > registrars don't.
> >
> > Another problem are such players as big tech making it hard to have use
> > of DNSSEC.
> Plus the major design flaw that DNSSEC is an automatic footgun. Any
> failure to regularly apply your signature refresh scripts with access
> to your secret keys causes the signed domain/zone to become unreadable.
> That scenario may be triggered by loss of the private key (think lost
> equipment) and/or any unfortunately timed interruption in ability to
> run the scripts.

Well, either you see the security important or you don't. If you fail,
learn and try again.

I don't think, that any noob should do their security. This should be
done by experts. And they need to be paid fair for that.

Gruß
   Klaus
-- 
Klaus Ethgen                                       http://www.ethgen.ch/
pub  4096R/4E20AF1C 2011-05-16            Klaus Ethgen <[email protected]>
Fingerprint: 85D4 CA42 952C 949B 1753  62B3 79D0 B06F 4E20 AF1C

_______________________________________________
Gnupg-users mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-users
signature.asc (application/pgp-signature, 728 B)