6 ms·

and exactly what country is safe from the whims of politics? I was just reading about censorship in the Netherlands and other Euro states because of fear of off

and exactly what country is safe from the whims of politics? I was just reading about censorship in the Netherlands and other Euro states because of fear of offending religious people, especially muslims. If the far left Europeans can't protect speech, then who can? DNNSEC just enables centralized government control on a level that's not needed. DNS is fine as-is. Domain authentication should be done via the transport layer like SSL. That's the way things are going now anyway.

stephenr 11y ago
Secure DNS allows a number of nice things that otherwise are a risk, such as trusting server SSH fingerprints without prompting on first use.
- tptacek 11y ago
  And to get that feature all you have to do is trust that the government that controls your TLD isn't going to fuck you. Because it's not like the USG would ever tamper with the DNS to further a policy goal, right? http://gizmodo.com/5936870/doj-seizes-domains-over-app-piracy-for-the-first-time-ever http://gizmodo.com/5936870/doj-seizes-domains-over-app-pirac...
  - throwaway2048 11y ago
    even in the case of existing CA model+key pinning (at least before the key is pinned) you are still trusting the governments controlling the TLDs are not going to fuck you. Id rather trust a handful of cctld nation states, than the nation states + everybody with access to a CA cert. Also the idea that dnssec tld keys cannot be rotated is pure FUD, the root key signing keys themseves cannot, but they were extremely careful there. If tampering is detected, do you really think TLD keys are going to be left alone, and not regenerated and the process extremely closely scrutinized?
  - caskance 11y ago
    That's the trust that government always requires. Being on the internet doesn't change the fact that the point of government is a monopoly on authorized use of force. They can always just send men with guns to your office, DNSSEC or no. If you don't trust your government not to abuse their power, that's not a problem that Cloudflare can help you with.
    - tptacek 11y ago
      We're required to trust them for the DNS today. We aren't required to trust them for TLS keys. But DNSSEC/DANE formally and irrevocably gives them that authority.
      - caskance 11y ago
        They already have the ability. Since that can't be revoked, might as well make it transparent and grant them the authority to match it. It's certainly better than the current CA system.
        tptacek 11y ago
        I know a lot of people seem to think that, but that's just not right. You can pin a certificate with X.509 CA TLS, and you can theoretically pin a certificate against DNSSEC/DANE (no browser does and it's unlikely they ever will; browsers flirted with DNSSEC a few years ago and that code has been withdrawn). But when you pin an X.509 CA cert, you can also punish CAs that issue fraudulent CAs that break pins. This has already happened several times. When you break a DNSSEC/DANE pin, you have no recourse. Everyone relies on the same .COM keys.
        caskance 11y ago
        The whole concept of certificates in the first place relies on your ability to keep the private key secret. You know what you really have no recourse to? The police coming when you are asleep and "interrogating" you until you give them access to the key.
  - phicoh 11y ago
    The nice thing about DNSSEC and the ccTLDs is that you can pick what country you trust. So you can get a domain in a country that is compatible with what you are trying to do. Of course, with domain validated SSL certificates, you also have to trust DNS completely, because anyone who controls your domain can get a cert for that domain.
    - tptacek 11y ago
      I hear this a lot too and it blows my mind. How is it a nice thing about DNSSEC that your choice of domain names will have a major impact on your security? That seems like a straightforwardly bad thing.
      - phicoh 11y ago
        That's a good thing. Because the same applies to just about anything else. Where your servers are, who announces your IP space. Or outside the internet, where you are living, where your company is registered, where you do business. The current CA system is the odd one out. Any CA in any country can create a cert for your domain that is recognized everywhere.
  - stephenr 11y ago
    So your entire argument against DNSSEC is that the US Government seized the domains of known "pirated" software distribution sites?

stephenr 11y ago

Secure DNS allows a number of nice things that otherwise are a risk, such as trusting server SSH fingerprints without prompting on first use.

tptacek 11y ago
And to get that feature all you have to do is trust that the government that controls your TLD isn't going to fuck you. Because it's not like the USG would ever tamper with the DNS to further a policy goal, right? http://gizmodo.com/5936870/doj-seizes-domains-over-app-piracy-for-the-first-time-ever http://gizmodo.com/5936870/doj-seizes-domains-over-app-pirac...
- throwaway2048 11y ago
  even in the case of existing CA model+key pinning (at least before the key is pinned) you are still trusting the governments controlling the TLDs are not going to fuck you. Id rather trust a handful of cctld nation states, than the nation states + everybody with access to a CA cert. Also the idea that dnssec tld keys cannot be rotated is pure FUD, the root key signing keys themseves cannot, but they were extremely careful there. If tampering is detected, do you really think TLD keys are going to be left alone, and not regenerated and the process extremely closely scrutinized?
- caskance 11y ago
  That's the trust that government always requires. Being on the internet doesn't change the fact that the point of government is a monopoly on authorized use of force. They can always just send men with guns to your office, DNSSEC or no. If you don't trust your government not to abuse their power, that's not a problem that Cloudflare can help you with.
  - tptacek 11y ago
    We're required to trust them for the DNS today. We aren't required to trust them for TLS keys. But DNSSEC/DANE formally and irrevocably gives them that authority.
    - caskance 11y ago
      They already have the ability. Since that can't be revoked, might as well make it transparent and grant them the authority to match it. It's certainly better than the current CA system.
      - tptacek 11y ago
        I know a lot of people seem to think that, but that's just not right. You can pin a certificate with X.509 CA TLS, and you can theoretically pin a certificate against DNSSEC/DANE (no browser does and it's unlikely they ever will; browsers flirted with DNSSEC a few years ago and that code has been withdrawn). But when you pin an X.509 CA cert, you can also punish CAs that issue fraudulent CAs that break pins. This has already happened several times. When you break a DNSSEC/DANE pin, you have no recourse. Everyone relies on the same .COM keys.
        caskance 11y ago
        The whole concept of certificates in the first place relies on your ability to keep the private key secret. You know what you really have no recourse to? The police coming when you are asleep and "interrogating" you until you give them access to the key.
- phicoh 11y ago
  The nice thing about DNSSEC and the ccTLDs is that you can pick what country you trust. So you can get a domain in a country that is compatible with what you are trying to do. Of course, with domain validated SSL certificates, you also have to trust DNS completely, because anyone who controls your domain can get a cert for that domain.
  - tptacek 11y ago
    I hear this a lot too and it blows my mind. How is it a nice thing about DNSSEC that your choice of domain names will have a major impact on your security? That seems like a straightforwardly bad thing.
    - phicoh 11y ago
      That's a good thing. Because the same applies to just about anything else. Where your servers are, who announces your IP space. Or outside the internet, where you are living, where your company is registered, where you do business. The current CA system is the odd one out. Any CA in any country can create a cert for your domain that is recognized everywhere.
- stephenr 11y ago
  So your entire argument against DNSSEC is that the US Government seized the domains of known "pirated" software distribution sites?