Support for DNS TXT record with master signing key for domain

[holderl5]

I was planning to write almost exactly this plugin when I found yours.

My original idea differed a little. I was thinking to place a public key into DNS that was used to sign any public key on the domain. I was also thinking an SSH client model for saving public keys, eg:

• you have never seen this public key before, do you want to save it?
• this public key changed from what you saved? Continue?
• Warning, the public key for this page is not signed by the key specified in the domain

I know this raises a lot of thorny issues code-wise, but I don't think they are insurmountable. Is this a direction you are interested in taking this plugin?

[tasn]

Hey,

Thanks for reaching out!

I agree that TOFU is great, that's why it was the first (#1) ticket ever to be opened on this repo, so I'd very much love to have that.

I don't think DNS is the best place for this. I think adding meta tags like in #18 is probably the best way forward. It avoids requiring any additional round-trips that may slow down loading and gives much more flexibility. One example would be the ability to sign pages that on domains of which you can't control the DNS. Think github pages, or even public directories (e.g. https://stosb.com/~tom/signed-pages/good.html notice the ~tom, it's just my public directory on the server).

Direction taking this plugin: as above, I don't think DNS is the best solution for the task, but I'm willing to be convinced. My only goal with this plugin is to make it better, so happy to do whatever helps achieving this goal. :)

What are your thoughts on the above? Are you wedded to DNS?

[holderl5]

I have a potentially bumpy schedule for the next 1-2 months, but I will look into #1

My original thinking did not include publishing code on pages outside of domains under my control, but your point about shared hosting and github is very relevant. If DNS remains in the cards, we quickly are approaching an issue something like what SPF solves.

I think meta tags would give us the flexibility to do either way, with DNS or without. I will look into #18 as well.

I mostly wanted to start a dialog around this, I think any further discussion could happen in other open issues. I am taking the liberty of closing this issue since there is a button here.

[tasn]

I made plenty of comments on #18 highlighting my views. I think that PR is mostly ready, or at least provides a stable base, but there's still some work to be done. Happy to give you pointers/discuss further if you'd like. You can either chat here (or as you suggested, another issue), reach out by email (available on my website https://stosb.com/about) or IRC (tasn @ freenode).

I am taking the liberty of closing this issue since there is a button here.

Haha, hanks. :P