5 ms·
You might not want to carry that argument any further, since Verisign, which I presume you mean, is the single biggest CA today. They can sign anything. They c
by xorcist 11y ago
You might not want to carry that argument any further, since Verisign, which I presume you mean, is the single biggest CA today. They can sign anything.
They can not, however, subvert the root zone any more. Not since it was singed in 2010.
- tptacek 11y agoDNSSEC advocates fetishize the security of the root zone, but are conspicuously silent about the trustworthiness of the DNS domains that really matter: .COM, &c.
- jessaustin 11y agoThis is just one reason why I'd love to see the creation of many thousands more TLDs. The importance of ".com" was always a temporarily contrived contingent condition, a false scarcity perpetuated in the seeking of rent. The sooner that's over the better. (Expecting users to read URIs was always a losing tactic, but surely everyone knows that now with IDNs.)
- xorcist 11y agoSince you replied to my comment, I just want to point out that I am not an "advocate" for DNSSEC, neither do I "fetishize" the security of anything. What I do is to point out that with today's domain validated model, it would make a lot more sense to restrict the validation path to only includes authoritative information about the domain, and to do so in a way that is cryptographically secure. The fact here is that Verisign can sign anything, today. They can not, however, impact the validation chain that DANE provides. There are also many millions of use cases where .com does not matter at all.
- tptacek 11y agoIf they control the keys for .COM, they absolutely can do that. Name an important domain, and let's see what world government controls its DNSSEC keys.
- xorcist 11y agoIt is a bit tiresome to write in this thread, with constant insinuations like "those who control .com control every domain" and "key pinning hasn't been dependent on trust-on-first-use for ages", but which are never spelled out. I'm not sure there are any further insights to gain. If you'd like, I will name an important domain with a trivial use case: skatteverket.se. It it the agency responsible not only of taxes but of nearly all personal data: marriages, deaths, everything. They have stringent security requirements for this, and to their users their security is infinitely more important than that of, say Facebook for example. In what way would their adoption of DNSSEC cede control of anything to the NSA, or to anyone?
- tptacek 11y agoIn a thread about user privacy and government control, I asked you for an example of a domain whose TLD might have some influence over how secure it would be post-DNSSEC. You provided the domain of a government agency. I think we can be done now, don't you?
- xorcist 11y agoThis thread is about the usefulness of DNSSEC. If you have another agenda than please be explicit about it so that we can have a fruitful conversation. You asked for a domain, any domain, and was prepared to show how Verisign could exercise their control over .com and somehow affect the validation path that DANE provides. At least that's what how I understood you. It's not always clear. You seem to argue that susceptibility to state level actors is a counterargument to the standard, so I gave one of the few examples I know of who really need to protect against such adversaries. Apparently my example was somehow a bad one. Take one of the big banks instead then? What could happen to swedbank.se if they signed their delegation with their TLD? Or why don't you provide an example instead, and show in what way signing it would cede control to the NSA, or to anyone else?
- tptacek 11y agoExamples: * Every .COM * Every .CO.UK * Every .COM.AU * Every .IO * Every .ORG Your response: * The Swedish tax authority's site.