4 ms·
> Anyone who can feed you spoofed DNS responses (i.e. starting from a cafe hotspot) would be able to impersonate just anything. Run a stub DNSSEC validator and
by AndyMcConachie 10y ago
> Anyone who can feed you spoofed DNS responses (i.e. starting from a cafe hotspot) would be able to impersonate just anything.
Run a stub DNSSEC validator and no one can feed you spoofed DNS responses if they're signed. DNSSEC doesn't require that validation only happen at the recursive server.
- rocqua 10y agoThat isn't going to work for the general public though. Not because it is too difficult to set up (that can be fixed by sane defaults). Instead the issue is dealing when you can't get DNSSEC responses. If you want DNSSEC to actually secure you, you need to reject any DNS answer that should have a signature, but doesn't. This means sites not working if there is a slight mistake upstream. Unless this shit becomes really rare, it seems unlikely people will accept this. If you ignore this, you are vulnerable to anyone who can spoof DNS and refuse to server RSIG records.
- AndyMcConachie 10y agoDNS records tend to hang around in caches, and people query the same RRs regularly. Thus, it's pretty hard to spoof a RR that you're regularly requesting. This doesn't help for those zones that are not DNSSEC enabled, but there's nothing you can really do about that. If a zone is DNSSEC signed and I query its records regularly(i.e. they stay in the cache) it would be very hard to spoof their records. If I also use a recursive resolver that does DNSSEC validation(e.g., 8.8.8.8) it's even harder. I'm not quite willing to say it would be impossible, but AFAIK no one has shown it to be possible.