This problem doesn't go away with DNS (in fact without DNS-Sec it's as good as a self-signed cert) and with DNSSec, state actors/root delegates can still act maliciously.
Granted, I still think it's a better option than the current CA system, it just doesn't magically make certain kind of attacks go away.
Surely if you're worried about state actors, this is no help?
Forcing a MITM to compromise DNSSEC before they can read the cleartext is a worthwhile barrier to add IMO.
It would hurt mail reachability, but are there any useful numbers as to how badly?
Additionally, it seems as though a solution analogous to HSTS might be better than involving DNSSEC. An SMTP server could advertise that it should be connected to only over TLS - information that could be cached by the sending system.
There is still a MITM problem on 1st connection, but that's an issue for many systems and avoids trusting DNSSEC.
* They say the combination of AES-128 and 2k RSA keys is secure
* The private key is stored on their servers (password needs to be set, but if security hinges on the private key password...)
* The website contains FUD (e.g. the FAQ [1])
* They have been sending UBE with loads of FUD to promote their services
[1] https://tutanota.de/#!faq (the language switch is all the way down at the bottom)
http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...
http://ianix.com/pub/dnssec-outages.html
Disclaimer: I work on DNSChain, a blockchain-based alternative to DNSSEC & X.509. Note that DNSChain does support blockchain-authenticated DANE TLSA records. In the future, DNSSEC's SIG record may be used to provide MITM-proof verification of the validity of that TLSA record for DNS-based apps.
I know 1k RSA isn't secure, but I thought 2k was.
from Schneier's post: https://www.schneier.com/blog/archives/2013/09/the_nsas_cryp...
There is some speculation that the NSA could potentially have quantum computers in which case RSA(and basically everything) is just fucked. Hopefully that's not the case (but hey, what your shadow budget is more than the rest of the world spends on crytopgrahy research combined then who knows, right?)
edit: This is just a hobby domain though.
That seems like a single point of failure to me.
Besides there are no CA's for SMTP anyway. Encryption is entirely opportunistic, and self-signed certs are just as trusted as ones signed by one of the CA's that people use for web traffic.
The difference with DANE+SMTP is, all of a sudden a sending server will know that it must use TLS or not send the message. And the cert it receives must match the one published in the DNS. Not just one that is signed by one of any hundreds of CAs.
