4 ms·

The current situation is that anyone can read DNS. If DNSSEC and DANE were implemented, that group would be restricted. In that sense it's better than the statu

The current situation is that anyone can read DNS. If DNSSEC and DANE were implemented, that group would be restricted. In that sense it's better than the status quo, though admittedly only a little bit. I'm all for implementing the perfect protocol if it exists or there is a known credible path to get there. But to my knowledge noone has proposed such a thing (namecoin maybe?), certainly not in a form that my grandmother would be likely to use. Do you have a suggestion for how you would like to see DNS evolve to fix these issues?

tptacek 11y ago
No. DNSSEC does not encrypt the DNS. After DNSSEC is implemented, everyone will still be able to read DNS. The major difference will be that sites will store their TLS keys in the DNS, and will thus have vouchsafed them with a new set of CAs controlled by the Five Eyes governments. DNSSEC isn't an imperfect protocol; it's harmful, a net loss. And here we have Snowden twice advocating for it.
- mike_hearn 11y ago
  DNSSEC is not DANE. All DNSSEC does is prevent MITM injection of DNS packets which is almost certainly one of the techniques QUANTUM INSERT uses. So no surprise he thinks DNS should be hardened against it. And as Chrome experimented with DANE then removed support for it, I don't think you have to worry about that either. But even if you did - so what? There are CAs in areas controlled by the American and British and French and Chinese governments already. I don't see how it makes anything different.
  - tptacek 11y ago
    1. He's the one who brought up DANE. 2. DNSSEC is harmful for reasons that go past DANE. 3. I am worried about DNSSEC; I think it's a more reasonable thing to be worried about w/r/t/ surveillance than 95% of what's been posted to The Intercept. 4. QUANTUM INSERT will work fine in an all-DNSSEC world. 5. You can revoke a CA. It has happened more than once. You can't revoke a TLD. I'm happy to talk more about how I think DANE CAs are different and worse than the 20391 X509 CAs we have today, but I'm not sure you're asking me to go on at length about that.
- throwaway7767 11y ago
  > No. DNSSEC does not encrypt the DNS. After DNSSEC is implemented, everyone will still be able to read DNS. The major difference will be that sites will store their TLS keys in the DNS, and will thus have vouchsafed them with a new set of CAs controlled by the Five Eyes governments. Fair enough, my knowledge of DNSSEC is limited. I thought it provided confidentiality in addition to authentication, but I see I was mistaken. I'm still not sure how you arrive at the conclusion that it is a net loss. Which attacks will DNSSEC enable that are not possible today? If you mean that it will give people a false sense of security, is that not the same as TLS today? Despite my hangups with the CA system I think we're better off with TLS than without it. The NSA certainly has no problems with intercepting DNS requests today with their QUANTUM tools. I am genuinely interested in hearing other ideas about how to provide confidentiality and authentication for DNS without central trust. Since you have clearly investigated these matters, I would like to ask again, are you aware of any promising projects or ideas in this regard? Because I would jump into the anti-DNSSEC camp in a heartbeat if one existed.
  - tptacek 11y ago
    I wrote a long piece that says everything I'd say in a comment here: http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/
    - throwaway7767 11y ago
      Thanks, that was a good read, and cleared up a lot of misunderstanding I had about DNSSEC! You make a strong argument that DNSSEC cannot deliver any real advantages. I did not see anything to support your earlier statement that it's worse than nothing, but given the general uselessness of the protocol, I certainly won't be deploying it.
      - thoughtpolice 11y ago
        One thing that makes it 'worse than nothing' is that it contributes to amplification attacks due to large response packets: http://dnscurve.org/amplification.html http://dnscurve.org/amplification.html
sarciszewski 11y ago
This is my wish list: * DNSCurve * Certificate Transparency * TACK * HPKP headers * HSTS headers * TLS 1.2 minimum * EdDSA TLS certificates (Ed25519 / Ed448-Goldilocks) Implement all of the above, and you've obsoleted any argument that DNSSEC advocates can make. Most of the people who I've seen advocate for DNSSEC are graybeard traditionalists who want centralized control, not cryptographers or security experts. A decentralized system like Namecoin, but more like Stellar (with EdDSA signatures please) than Bitcoin, would probably serve as an appropriate replacement for DNSSEC. But even that probably isn't necessary. Every sane end-to-end encryption protocol assumes DNS is insecure anyway.
- marcosdumay 11y ago
  > Implement all of the above, and you've obsoleted any argument that DNSSEC advocates can make. Still no offline signatures. How is it that centralized control is worse than the TLS's "everybody has full power to impersonate you" decentralization? You know that Certificate Transparency is still subject to MITM attacks, right? It just makes it obvious that you were victim of one after the fact (if there is an "after the fact").
  - sarciszewski 11y ago
    You can have offline signatures in a design for a Stellar/Namecoin/EdDSA decentralized protocol. > How is it that centralized control is worse than the TLS's "everybody has full power to impersonate you" decentralization? You know that Certificate Transparency is still subject to MITM attacks, right? It just makes it obvious that you were victim of one after the fact (if there is an "after the fact"). This is non sequitur. You're comparing a bad option where only a few can screw you over (DNSSEC) with a bad option where lots can screw you over (CAs). I want a protocol where no one can screw you over, except yourself. And I want the government to be powerless to do anything about it without your consent. And if it function with high anonymity (e.g. with Tor Hidden Services on servers purchased with cryptocurrencies), all the better.

tptacek 11y ago

No. DNSSEC does not encrypt the DNS. After DNSSEC is implemented, everyone will still be able to read DNS. The major difference will be that sites will store their TLS keys in the DNS, and will thus have vouchsafed them with a new set of CAs controlled by the Five Eyes governments. DNSSEC isn't an imperfect protocol; it's harmful, a net loss. And here we have Snowden twice advocating for it.

mike_hearn 11y ago
DNSSEC is not DANE. All DNSSEC does is prevent MITM injection of DNS packets which is almost certainly one of the techniques QUANTUM INSERT uses. So no surprise he thinks DNS should be hardened against it. And as Chrome experimented with DANE then removed support for it, I don't think you have to worry about that either. But even if you did - so what? There are CAs in areas controlled by the American and British and French and Chinese governments already. I don't see how it makes anything different.
- tptacek 11y ago
  1. He's the one who brought up DANE. 2. DNSSEC is harmful for reasons that go past DANE. 3. I am worried about DNSSEC; I think it's a more reasonable thing to be worried about w/r/t/ surveillance than 95% of what's been posted to The Intercept. 4. QUANTUM INSERT will work fine in an all-DNSSEC world. 5. You can revoke a CA. It has happened more than once. You can't revoke a TLD. I'm happy to talk more about how I think DANE CAs are different and worse than the 20391 X509 CAs we have today, but I'm not sure you're asking me to go on at length about that.
throwaway7767 11y ago
> No. DNSSEC does not encrypt the DNS. After DNSSEC is implemented, everyone will still be able to read DNS. The major difference will be that sites will store their TLS keys in the DNS, and will thus have vouchsafed them with a new set of CAs controlled by the Five Eyes governments. Fair enough, my knowledge of DNSSEC is limited. I thought it provided confidentiality in addition to authentication, but I see I was mistaken. I'm still not sure how you arrive at the conclusion that it is a net loss. Which attacks will DNSSEC enable that are not possible today? If you mean that it will give people a false sense of security, is that not the same as TLS today? Despite my hangups with the CA system I think we're better off with TLS than without it. The NSA certainly has no problems with intercepting DNS requests today with their QUANTUM tools. I am genuinely interested in hearing other ideas about how to provide confidentiality and authentication for DNS without central trust. Since you have clearly investigated these matters, I would like to ask again, are you aware of any promising projects or ideas in this regard? Because I would jump into the anti-DNSSEC camp in a heartbeat if one existed.
- tptacek 11y ago
  I wrote a long piece that says everything I'd say in a comment here: http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/
  - throwaway7767 11y ago
    Thanks, that was a good read, and cleared up a lot of misunderstanding I had about DNSSEC! You make a strong argument that DNSSEC cannot deliver any real advantages. I did not see anything to support your earlier statement that it's worse than nothing, but given the general uselessness of the protocol, I certainly won't be deploying it.
    - thoughtpolice 11y ago
      One thing that makes it 'worse than nothing' is that it contributes to amplification attacks due to large response packets: http://dnscurve.org/amplification.html http://dnscurve.org/amplification.html

sarciszewski 11y ago

This is my wish list: * DNSCurve * Certificate Transparency * TACK * HPKP headers * HSTS headers * TLS 1.2 minimum * EdDSA TLS certificates (Ed25519 / Ed448-Goldilocks) Implement all of the above, and you've obsoleted any argument that DNSSEC advocates can make. Most of the people who I've seen advocate for DNSSEC are graybeard traditionalists who want centralized control, not cryptographers or security experts. A decentralized system like Namecoin, but more like Stellar (with EdDSA signatures please) than Bitcoin, would probably serve as an appropriate replacement for DNSSEC. But even that probably isn't necessary. Every sane end-to-end encryption protocol assumes DNS is insecure anyway.

marcosdumay 11y ago
> Implement all of the above, and you've obsoleted any argument that DNSSEC advocates can make. Still no offline signatures. How is it that centralized control is worse than the TLS's "everybody has full power to impersonate you" decentralization? You know that Certificate Transparency is still subject to MITM attacks, right? It just makes it obvious that you were victim of one after the fact (if there is an "after the fact").
- sarciszewski 11y ago
  You can have offline signatures in a design for a Stellar/Namecoin/EdDSA decentralized protocol. > How is it that centralized control is worse than the TLS's "everybody has full power to impersonate you" decentralization? You know that Certificate Transparency is still subject to MITM attacks, right? It just makes it obvious that you were victim of one after the fact (if there is an "after the fact"). This is non sequitur. You're comparing a bad option where only a few can screw you over (DNSSEC) with a bad option where lots can screw you over (CAs). I want a protocol where no one can screw you over, except yourself. And I want the government to be powerless to do anything about it without your consent. And if it function with high anonymity (e.g. with Tor Hidden Services on servers purchased with cryptocurrencies), all the better.