3 ms·

Could you elaborate on the link between DNSSEC and the FVEY? > * The FVEY IC gains de jure control over the TLS keys all of the Internet's most important sites

Could you elaborate on the link between DNSSEC and the FVEY? > * The FVEY IC gains de jure control over the TLS keys all of the Internet's most important sites, including (along with the COMs and NETs and CO.UKs) every .IO host. Please prove the above assertion. Everytime I see you post something about DNSSEC I ask you these same questions and I've never gotten a response from you that elucidates this link. What is it exactly about DNSSEC that you think it gives controls to world governments? Spell it out for me in as much detail as possible.

tptacek 10y ago
I remain confused by this question. The USG controls COM, ORG, NET, and US. The UK government, host of GCHQ, the world's most unhinged SIGINT agency, controls CO.UK, NET.UK, and IO.
- AndyMcConachie 10y ago
  > The USG controls COM, ORG, NET, and US. Verisign is the registry for .com and .net. PIR is the registry for .org. Neustar is the registry for .us. What exactly do you mean by the US controls them? Do you mean that because they are on US property and operate in a US jurisdiction that the USG controls them? In that case wouldn't it be fair to say that any US concern operating in USG jurisdiction(e.g. Comodo, Google, Mozilla, Let's Encrypt) are also controlled by the USG? Or is there something specific about DNS registries that makes them special?
ChoHag 10y ago
DNSSEC is adding a cryptographic-trust-negotion layer to DNS. Governments are in control of DNS, ergo governments would be in control of the new layer which DNSSEC adds to it. DNSSEC is adding a means of cryptographically verifying the government control already implicit in DNS. The way to keep government controls away from your own cryptographic trust negotiation is not to not implement DNSSEC but to implement your own DNS root with its own DNSSEC* , or to implement your own orthogonal trust negotiation such as the various PKI models currently in use. [* ] Before anyone argues, this is exactly what you do when you host a domain in your own DNS server. The vast majority simply defer the rest of the DNS to 3rd party resolvers. I'm sure DNSSEC is able to cope with a situation wherein you own and host only a subdomain and keep the DNS hierarchy above you from being able to override or in any way interfere with your DNSSEC controls.
- AndyMcConachie 10y ago
  >Governments are in control of DNS Again I am confused by this statement which you take for granted. Prove it.

tptacek 10y ago

I remain confused by this question. The USG controls COM, ORG, NET, and US. The UK government, host of GCHQ, the world's most unhinged SIGINT agency, controls CO.UK, NET.UK, and IO.

AndyMcConachie 10y ago
> The USG controls COM, ORG, NET, and US. Verisign is the registry for .com and .net. PIR is the registry for .org. Neustar is the registry for .us. What exactly do you mean by the US controls them? Do you mean that because they are on US property and operate in a US jurisdiction that the USG controls them? In that case wouldn't it be fair to say that any US concern operating in USG jurisdiction(e.g. Comodo, Google, Mozilla, Let's Encrypt) are also controlled by the USG? Or is there something specific about DNS registries that makes them special?

ChoHag 10y ago

DNSSEC is adding a cryptographic-trust-negotion layer to DNS. Governments are in control of DNS, ergo governments would be in control of the new layer which DNSSEC adds to it. DNSSEC is adding a means of cryptographically verifying the government control already implicit in DNS. The way to keep government controls away from your own cryptographic trust negotiation is not to not implement DNSSEC but to implement your own DNS root with its own DNSSEC* , or to implement your own orthogonal trust negotiation such as the various PKI models currently in use. [* ] Before anyone argues, this is exactly what you do when you host a domain in your own DNS server. The vast majority simply defer the rest of the DNS to 3rd party resolvers. I'm sure DNSSEC is able to cope with a situation wherein you own and host only a subdomain and keep the DNS hierarchy above you from being able to override or in any way interfere with your DNSSEC controls.

AndyMcConachie 10y ago
>Governments are in control of DNS Again I am confused by this statement which you take for granted. Prove it.