4 ms·

I wouldn't say that Snowden was intending to provide technical (or specifically cryptographic) advice in this Q&A. I would compare it to a power user giving fee

by pfg 11y ago

I wouldn't say that Snowden was intending to provide technical (or specifically cryptographic) advice in this Q&A. I would compare it to a power user giving feedback to the engineers working on improving their software. What he brings to the table in discussions like this is basically having worked with people on surveillance projects. He knows how they operate and where they'd look for attack vectors. I think that's valuable when you have to think about designing any system with any kind of security requirements. He literally stated himself that what he says shouldn't be accepted as gospel, and in a later question about MITM specifically confirmed that it's not his area of expertise. I don't think there's any risk of people suddenly jumping on the DNSSEC bandwagon just because of his lukewarm support.

tptacek 11y ago
His support isn't lukewarm. Also: now, when DNSSEC is almost dead, is the most important time to ensure that it actually becomes fully dead. It's like a zombie. You have to cut off the head and burn the body. DNSSEC is still intact and twitching.
- pfg 11y ago
  I wouldn't classify statements like "we gotta start somewhere and then we've got to iterate from that point" or "It's better than what we have today" as a call to action to drop everything and start implementing DNSSEC as-is right away. I would interpret it as "yes, DNSSEC improves the situation in that it provides authenticated DNS replies (which - by itself - is an improvement, even though it's no magic wand that, alone, solves the cert trust issue), but there are legitimate concerns that need to be taken care of before it becomes really useful."
  - tptacek 11y ago
    "DNSSEC improves the situation" is (a) false and (b) a concession to the narrative that DNSSEC is worth doing. Someone actively engaged in trying to prevent centralization of Internet trust, and decoupling it from the Five Eyes governments --- a worthy goal, I think --- should be adamantly against DNSSEC. But here's Snowden doing the opposite. It's not because Snowden is disingenuous. I think he's a true-believer. It's because he doesn't understand DNSSEC.

by pfg 11y ago

tptacek 11y ago

His support isn't lukewarm. Also: now, when DNSSEC is almost dead, is the most important time to ensure that it actually becomes fully dead. It's like a zombie. You have to cut off the head and burn the body. DNSSEC is still intact and twitching.

pfg 11y ago
I wouldn't classify statements like "we gotta start somewhere and then we've got to iterate from that point" or "It's better than what we have today" as a call to action to drop everything and start implementing DNSSEC as-is right away. I would interpret it as "yes, DNSSEC improves the situation in that it provides authenticated DNS replies (which - by itself - is an improvement, even though it's no magic wand that, alone, solves the cert trust issue), but there are legitimate concerns that need to be taken care of before it becomes really useful."
- tptacek 11y ago
  "DNSSEC improves the situation" is (a) false and (b) a concession to the narrative that DNSSEC is worth doing. Someone actively engaged in trying to prevent centralization of Internet trust, and decoupling it from the Five Eyes governments --- a worthy goal, I think --- should be adamantly against DNSSEC. But here's Snowden doing the opposite. It's not because Snowden is disingenuous. I think he's a true-believer. It's because he doesn't understand DNSSEC.