14 ms·

Universal DNSSEC: Secure DNS for Every Domain

145 points by hepha1979 11y ago

peterwwillis 11y ago
To recap the ways DNSSEC sucks for users: * The server/nameserver must have DNSSEC configured properly (CloudFlare have solved this for their customers) * Your client's DNS resolving server must support DNSSEC properly (which they might not, depends on the user's network) * Your client's stub resolver must verify all DNSSEC records (most do not currently) If any of the above fail, you will not have any indication whatsoever and you will be using regular DNS. The only time that a user will ever know if DNSSEC is working (for them) is if the server/nameserver are configured correctly, your client's dns resolver supports DNSSEC, your client's stub resolver verifies requests, and then the user tries to look up a known-invalid domain and it gives them a resolving error. Otherwise, they will never know if DNSSEC is in use. Oh, and you can still MITM the data connection between the client and server even if DNSSEC works.
jedisct1 11y ago
A big step towards making the Internet more secure. Kudos to Cloudflare for the amazing work they did.
tptacek 11y ago
If DNS is the phone book of the Internet, DNSSEC is the unspoofable caller ID. DNSSEC ensures that a website’s traffic is safely directed to the correct servers, so that a connection to a website is not intercepted by a man-in-the-middle. No, it doesn't. DNSSEC secures server-to-server DNS lookups, not the client-to-server lookups that your browser generates. DNSSEC is far less valuable than its proponents would like you to believe, and it comes at a significant cost to Internet trust: its real use case, that of replacing the CAs with DNS TLD operators, has the net effect of signing Internet cryptographic trust over to the world governments that control the most important TLDs. It's understandable that Cloudflare would jump on DNSSEC: the protocol is famously annoying to deploy and has caused major outages, including breaking the first day of HBO Now across all of Comcast. DNSSEC is an opportunity for a company like Cloudflare to make the case that they should manage your infrastructure, not you; the more features like DNSSEC Cloudflare can find, the more market share they'll acquire. But make no mistake: DNSSEC isn't about helping you with your security issues. Obligatory: http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/
- sarciszewski 11y ago
  Hmm. Think they'll adopt DNSCrypt next?
  - tptacek 11y ago
    DNSCrypt, which is far better and less costly than DNSSEC and does not cede to the US Government control over TLS keys, was proposed and deployed by a Cloudflare competitor. So, no.
    - fweespeech 11y ago
      Which competitor?
      - sarciszewski 11y ago
        OpenDNS: https://www.opendns.com/about/innovations/dnscrypt/ https://www.opendns.com/about/innovations/dnscrypt/
        fweespeech 11y ago
        As far as I'm aware, OpenDNS doesn't provide CDN-esque security services and is purely a DNS provider?
        jamespo 11y ago
        Oracle don't produce a browser but still compete with Google and Microsoft in other areas
        fweespeech 11y ago
        Yeah, but unless its something like Incapsula that functions as a direct replacement ... its not really competitive with Cloudflare's value proposition. You don't use Cloudflare as a DNS provider. Their value proposition [imho] is as a CDN/WAF. I was genuinely hoping someone like Sucuri or Incapsula had picked it up.
enginnr 11y ago
DNS is often the weakest link in the chain and well worth hardening if you're doing proactive sec. Combined with DNSCrypt it can be a pretty robust setup. My only problem with DNS hardening is zero-knowledge problems. See https://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof It is possible to encrypt DNS queries, but tricky for end points to deny knowledge of having requested it, and so we have zero-knowledge proof issues.
ausjke 11y ago
That's what I want to do: enabled dnssec in dnsmasq and run it on my router.
- jedisct1 11y ago
  Yep, dnsmasq finally supporting DNSSEC is an excellent thing. Alternative router firmwares such as Tomato Shibby support DNSSEC validation out of the box, thanks to this. I wish more and more routers (most of them running dnsmasq) would also do this.
  - rb12345 11y ago
    On recent Ubuntu releases, you can enable DNSSEC resolving by adding the following to "/etc/NetworkManager/dnsmasq.d/dnsmasq.conf": dnssec #dnssec-check-unsigned conf-file=/usr/share/dnsmasq-base/trust-anchors.conf Of course, it's possible to strip the signing unless you use Google DNS or whatever and uncomment the "dnssec-check-unsigned" line.
    - jedisct1 11y ago
      Why isn't is enabled by default?
pbreit 11y ago
I may or may not use Cloudflare's core service but would it still be a reasonable place to host my DNS entries?
- benjaminl 11y ago
  I am not sure if Clouflare would advocate this use case, but quick DNS is actually a crucial part of a quick loading site, and it is surprisingly hard to get reasonably priced high performance DNS. I have been using Cloudflare just for DNS for my hobby site and it has been working great.
mike-cardwell 11y ago
Also of relevance: https://www.mail-archive.com/dane-users@sys4.de/msg00142.html https://www.mail-archive.com/dane-users@sys4.de/msg00142.htm... Comcast published TLSA records the other day. So when people like myself who have enabled TLSA in Postfix send email to Comcast users, the SMTP connection is guaranteed to be both encrypted, and the SSL cert validated.
danyork 11y ago
This is great news for those of us who want to see DNSSEC more widely deployed for three reasons: 1. CloudFlare already hosts the DNS for millions of domains. This is now making it VERY easy for those who use CloudFlare to sign their domains with DNSSEC. 2. Because of the competition within the DNS hosting / operator space, this move by CloudFlare will hopefully motivate the other large DNS operators to simplify their own user experience for DNSSEC. 3. For those of us who want to see stronger crypto within DNSSEC, this move by CloudFlare advances the use of an elliptic curve algorithm. Yes, ECDSA has its issues, but by getting it out there: a) it gets people looking at EC algorithms; and b) it gets software providers realizing they need to have their user interfaces adaptable to incorporate more DNSSEC algorithms. (I.e. to realize the list is NOT fixed and will grow over time.) As I said in another comment ( https://news.ycombinator.com/item?id=10553383 https://news.ycombinator.com/item?id=10553383 ) there is a draft out there to add Ed25519 as a DNSSEC algorithm: https://tools.ietf.org/html/draft-sury-dnskey-ed25519-01 https://tools.ietf.org/html/draft-sury-dnskey-ed25519-01 This draft needs to be approved through the IETF working groups - and then deployed on both the signing and validation sides of DNSSEC. This will take quite some time and so we need to start as soon as we can.

145 points by hepha1979 11y ago

To recap the ways DNSSEC sucks for users: * The server/nameserver must have DNSSEC configured properly (CloudFlare have solved this for their customers) * Your client's DNS resolving server must support DNSSEC properly (which they might not, depends on the user's network) * Your client's stub resolver must verify all DNSSEC records (most do not currently) If any of the above fail, you will not have any indication whatsoever and you will be using regular DNS. The only time that a user will ever know if DNSSEC is working (for them) is if the server/nameserver are configured correctly, your client's dns resolver supports DNSSEC, your client's stub resolver verifies requests, and then the user tries to look up a known-invalid domain and it gives them a resolving error. Otherwise, they will never know if DNSSEC is in use. Oh, and you can still MITM the data connection between the client and server even if DNSSEC works.

jedisct1 11y ago

A big step towards making the Internet more secure. Kudos to Cloudflare for the amazing work they did.

tptacek 11y ago

If DNS is the phone book of the Internet, DNSSEC is the unspoofable caller ID. DNSSEC ensures that a website’s traffic is safely directed to the correct servers, so that a connection to a website is not intercepted by a man-in-the-middle. No, it doesn't. DNSSEC secures server-to-server DNS lookups, not the client-to-server lookups that your browser generates. DNSSEC is far less valuable than its proponents would like you to believe, and it comes at a significant cost to Internet trust: its real use case, that of replacing the CAs with DNS TLD operators, has the net effect of signing Internet cryptographic trust over to the world governments that control the most important TLDs. It's understandable that Cloudflare would jump on DNSSEC: the protocol is famously annoying to deploy and has caused major outages, including breaking the first day of HBO Now across all of Comcast. DNSSEC is an opportunity for a company like Cloudflare to make the case that they should manage your infrastructure, not you; the more features like DNSSEC Cloudflare can find, the more market share they'll acquire. But make no mistake: DNSSEC isn't about helping you with your security issues. Obligatory: http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/

sarciszewski 11y ago
Hmm. Think they'll adopt DNSCrypt next?
- tptacek 11y ago
  DNSCrypt, which is far better and less costly than DNSSEC and does not cede to the US Government control over TLS keys, was proposed and deployed by a Cloudflare competitor. So, no.
  - fweespeech 11y ago
    Which competitor?
    - sarciszewski 11y ago
      OpenDNS: https://www.opendns.com/about/innovations/dnscrypt/ https://www.opendns.com/about/innovations/dnscrypt/
      - fweespeech 11y ago
        As far as I'm aware, OpenDNS doesn't provide CDN-esque security services and is purely a DNS provider?
        jamespo 11y ago
        Oracle don't produce a browser but still compete with Google and Microsoft in other areas
        fweespeech 11y ago
        Yeah, but unless its something like Incapsula that functions as a direct replacement ... its not really competitive with Cloudflare's value proposition. You don't use Cloudflare as a DNS provider. Their value proposition [imho] is as a CDN/WAF. I was genuinely hoping someone like Sucuri or Incapsula had picked it up.

enginnr 11y ago

DNS is often the weakest link in the chain and well worth hardening if you're doing proactive sec. Combined with DNSCrypt it can be a pretty robust setup. My only problem with DNS hardening is zero-knowledge problems. See https://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof It is possible to encrypt DNS queries, but tricky for end points to deny knowledge of having requested it, and so we have zero-knowledge proof issues.

ausjke 11y ago

That's what I want to do: enabled dnssec in dnsmasq and run it on my router.

jedisct1 11y ago
Yep, dnsmasq finally supporting DNSSEC is an excellent thing. Alternative router firmwares such as Tomato Shibby support DNSSEC validation out of the box, thanks to this. I wish more and more routers (most of them running dnsmasq) would also do this.
- rb12345 11y ago
  On recent Ubuntu releases, you can enable DNSSEC resolving by adding the following to "/etc/NetworkManager/dnsmasq.d/dnsmasq.conf": dnssec #dnssec-check-unsigned conf-file=/usr/share/dnsmasq-base/trust-anchors.conf Of course, it's possible to strip the signing unless you use Google DNS or whatever and uncomment the "dnssec-check-unsigned" line.
  - jedisct1 11y ago
    Why isn't is enabled by default?

pbreit 11y ago

I may or may not use Cloudflare's core service but would it still be a reasonable place to host my DNS entries?

benjaminl 11y ago
I am not sure if Clouflare would advocate this use case, but quick DNS is actually a crucial part of a quick loading site, and it is surprisingly hard to get reasonably priced high performance DNS. I have been using Cloudflare just for DNS for my hobby site and it has been working great.

mike-cardwell 11y ago

Also of relevance: https://www.mail-archive.com/dane-users@sys4.de/msg00142.html https://www.mail-archive.com/dane-users@sys4.de/msg00142.htm... Comcast published TLSA records the other day. So when people like myself who have enabled TLSA in Postfix send email to Comcast users, the SMTP connection is guaranteed to be both encrypted, and the SSL cert validated.

danyork 11y ago

This is great news for those of us who want to see DNSSEC more widely deployed for three reasons: 1. CloudFlare already hosts the DNS for millions of domains. This is now making it VERY easy for those who use CloudFlare to sign their domains with DNSSEC. 2. Because of the competition within the DNS hosting / operator space, this move by CloudFlare will hopefully motivate the other large DNS operators to simplify their own user experience for DNSSEC. 3. For those of us who want to see stronger crypto within DNSSEC, this move by CloudFlare advances the use of an elliptic curve algorithm. Yes, ECDSA has its issues, but by getting it out there: a) it gets people looking at EC algorithms; and b) it gets software providers realizing they need to have their user interfaces adaptable to incorporate more DNSSEC algorithms. (I.e. to realize the list is NOT fixed and will grow over time.) As I said in another comment ( https://news.ycombinator.com/item?id=10553383 https://news.ycombinator.com/item?id=10553383 ) there is a draft out there to add Ed25519 as a DNSSEC algorithm: https://tools.ietf.org/html/draft-sury-dnskey-ed25519-01 https://tools.ietf.org/html/draft-sury-dnskey-ed25519-01 This draft needs to be approved through the IETF working groups - and then deployed on both the signing and validation sides of DNSSEC. This will take quite some time and so we need to start as soon as we can.