2 ms·

because its impossible to pin everyone and everything everywhere. No matter what you are stuck trusting that dns roots arn't being evil in the case of unpinned

by throwaway2048 11y ago

because its impossible to pin everyone and everything everywhere. No matter what you are stuck trusting that dns roots arn't being evil in the case of unpinned cert. At least with DNSSEC you arnt stuck additionally trusting every CA on earth in the case an attacker can mitm, but dosent control said tld.

tptacek 11y ago
The one CA on Earth DNSSEC asks most Internet users to trust is controlled by the f^cking NSA. How is this progress?
- throwaway2048 11y ago
  because i would rather have to deal with the NSA, than everyone else + the NSA. The level of tampering required for the NSA to fake DNSSEC replies is very evident if you have the cert pinned, and very hard to deny. As things stand, its very easy to deny it was the NSA when anyone and their dog can have access to a CA cert.
- xorcist 11y ago
  You might not want to carry that argument any further, since Verisign, which I presume you mean, is the single biggest CA today. They can sign anything. They can not, however, subvert the root zone any more. Not since it was singed in 2010.
  - tptacek 11y ago
    DNSSEC advocates fetishize the security of the root zone, but are conspicuously silent about the trustworthiness of the DNS domains that really matter: .COM, &c.
    - jessaustin 11y ago
      This is just one reason why I'd love to see the creation of many thousands more TLDs. The importance of ".com" was always a temporarily contrived contingent condition, a false scarcity perpetuated in the seeking of rent. The sooner that's over the better. (Expecting users to read URIs was always a losing tactic, but surely everyone knows that now with IDNs.)
    - xorcist 11y ago
      Since you replied to my comment, I just want to point out that I am not an "advocate" for DNSSEC, neither do I "fetishize" the security of anything. What I do is to point out that with today's domain validated model, it would make a lot more sense to restrict the validation path to only includes authoritative information about the domain, and to do so in a way that is cryptographically secure. The fact here is that Verisign can sign anything, today. They can not, however, impact the validation chain that DANE provides. There are also many millions of use cases where .com does not matter at all.
      - tptacek 11y ago
        If they control the keys for .COM, they absolutely can do that. Name an important domain, and let's see what world government controls its DNSSEC keys.
        xorcist 11y ago
        It is a bit tiresome to write in this thread, with constant insinuations like "those who control .com control every domain" and "key pinning hasn't been dependent on trust-on-first-use for ages", but which are never spelled out. I'm not sure there are any further insights to gain. If you'd like, I will name an important domain with a trivial use case: skatteverket.se. It it the agency responsible not only of taxes but of nearly all personal data: marriages, deaths, everything. They have stringent security requirements for this, and to their users their security is infinitely more important than that of, say Facebook for example. In what way would their adoption of DNSSEC cede control of anything to the NSA, or to anyone?
        tptacek 11y ago
        In a thread about user privacy and government control, I asked you for an example of a domain whose TLD might have some influence over how secure it would be post-DNSSEC. You provided the domain of a government agency. I think we can be done now, don't you?
        11y ago

tptacek 11y ago

The one CA on Earth DNSSEC asks most Internet users to trust is controlled by the f^cking NSA. How is this progress?

throwaway2048 11y ago
because i would rather have to deal with the NSA, than everyone else + the NSA. The level of tampering required for the NSA to fake DNSSEC replies is very evident if you have the cert pinned, and very hard to deny. As things stand, its very easy to deny it was the NSA when anyone and their dog can have access to a CA cert.
xorcist 11y ago
You might not want to carry that argument any further, since Verisign, which I presume you mean, is the single biggest CA today. They can sign anything. They can not, however, subvert the root zone any more. Not since it was singed in 2010.
- tptacek 11y ago
  DNSSEC advocates fetishize the security of the root zone, but are conspicuously silent about the trustworthiness of the DNS domains that really matter: .COM, &c.
  - jessaustin 11y ago
    This is just one reason why I'd love to see the creation of many thousands more TLDs. The importance of ".com" was always a temporarily contrived contingent condition, a false scarcity perpetuated in the seeking of rent. The sooner that's over the better. (Expecting users to read URIs was always a losing tactic, but surely everyone knows that now with IDNs.)
  - xorcist 11y ago
    Since you replied to my comment, I just want to point out that I am not an "advocate" for DNSSEC, neither do I "fetishize" the security of anything. What I do is to point out that with today's domain validated model, it would make a lot more sense to restrict the validation path to only includes authoritative information about the domain, and to do so in a way that is cryptographically secure. The fact here is that Verisign can sign anything, today. They can not, however, impact the validation chain that DANE provides. There are also many millions of use cases where .com does not matter at all.
    - tptacek 11y ago
      If they control the keys for .COM, they absolutely can do that. Name an important domain, and let's see what world government controls its DNSSEC keys.
      - xorcist 11y ago
        It is a bit tiresome to write in this thread, with constant insinuations like "those who control .com control every domain" and "key pinning hasn't been dependent on trust-on-first-use for ages", but which are never spelled out. I'm not sure there are any further insights to gain. If you'd like, I will name an important domain with a trivial use case: skatteverket.se. It it the agency responsible not only of taxes but of nearly all personal data: marriages, deaths, everything. They have stringent security requirements for this, and to their users their security is infinitely more important than that of, say Facebook for example. In what way would their adoption of DNSSEC cede control of anything to the NSA, or to anyone?
        tptacek 11y ago
        In a thread about user privacy and government control, I asked you for an example of a domain whose TLD might have some influence over how secure it would be post-DNSSEC. You provided the domain of a government agency. I think we can be done now, don't you?
        11y ago