4 ms·

> * DANE is effectively a key escrow system. COM's keys would be held by the USG. They can already temporarily change DNS records and get certificate from any

> * DANE is effectively a key escrow system. COM's keys would be held by the USG. They can already temporarily change DNS records and get certificate from any legitimate CA. > * In the same vein: people with cosmetic TLDs like .LY would be forced to concede their TLS policy to governments like Libya. They already are doing this, see first point. > * The "last mile" on DANE is spoofable, because DNSSEC doesn't protect the link between browsers and DNS servers; it's a "server-to-server" protocol. In particular: your ISP could still override pins! Run a local resolver. If you have trusted server some you can use DNS over TLS. * DANE doesn't actually work in practice, because of all the networks that block odd-looking DNS lookups; this is Adam Langley's point from "Why Not DANE In Browsers". Then these networks are bad. For what reason network should be interested with more than UDP/TCP layer in DNS packet? Again, you can use DNS over TLS. For other readers, look at discussion in https://news.ycombinator.com/item?id=12382752 https://news.ycombinator.com/item?id=12382752

tptacek 10y ago
Regarding your first point: no, they can't. See what happens if they try to exploit the DNS to get a Google certificate. (Notice the last several years of Google punishing CAs). It is very important to DNSSEC advocates to convince people that our security can't be any better than the security of the .COM zone, which is controlled by the US Government through Verisign. But nobody accepts that level of security today. Arguments that we can escrow all our security with Verisign are DOA, post Snowden. Move on. Regarding the rest: you can't persuasively rebut arguments by conceding they're correct.
- garaetjjte 10y ago
  > Regarding your first point: no, they can't. See what happens if they try to exploit the DNS to get a Google certificate. (Notice the last several years of Google punishing CAs). What? Article about it on HN? They won't punish CAs for that, because that won't be CA fault that USG modified DNS zone. > It is very important to DNSSEC advocates to convince people that our security can't be any better than the security of the .COM zone, which is controlled by the US Government through Verisign. But nobody accepts that level of security today. Arguments that we can escrow all our security with Verisign are DOA, post Snowden. Move on. Because it can't be better with DNS, which is by design hierarchical. You would have to create own domains as TLD in root zone. Oops, you now have to trust root zone owners! So you can create blockchain based domain system. But, it won't be DNS. And you will argue that implementing blockchain name system is even more expensive to implement than DNSSEC, because it is slow and requires big storage space. > Regarding the rest: you can't persuasively rebut arguments by conceding they're correct. Last mile problems aren't covered with DNSSEC, there is other RFC for that.
  - tptacek 10y ago
    You've missed my point. The reason you can't DNS spoof to obtain a Google certificate is that the certificate is pinned, and CAs are monitored (through both pins and through CT). The rest of this comment continues to concede the arguments I made previously, but pretend that those concessions are rebuttals. It's really only in DNSSEC threads that I notice this peculiar rhetorical strategy deployed.
- rocqua 10y ago
  Sure, Google is defended, as are some other big sites. However, this isn't a scalable solution. Are you really going to argue that the sites small enough not to be statically pinned don't deserve to be safe from state-level attacks?
  - tptacek 10y ago
    No? That's what HPKP does: it allows sites of any size to pin certificates.
    - rocqua 10y ago
      I'd say the article shows plenty of issues with HKPK. It also forgoes the fact that HKPK only works on the second visit.
      - tptacek 10y ago
        For that one user. But part of the point of HPKP is that it raises the stakes for CAs who would issue bogus certificates: someone will have their pin broken, browsers will notice, CAs will be forced into CT or worse.
        rocqua 10y ago
        I have kinda lost faith in the stakes for CAs. It seems like they have to fuck over a really big client for anything to happen. In general, the CA system is fucked and we need a new one. Note that I never said DANE should be the replacement for CAs. Instead I wanted DANE pinnen to replace HPKP. I wonder if any if this is even relevant when you consider downgrade attacks.
        tptacek 10y ago
        Everyone has lost faith in the CA system. The problem is that DANE doubles down on it by creating a new hierarchical PKI, this time de jure controlled by governments. And it's not even a good PKI! It's a PKI built around 1990s cryptography. DANE is not the answer. Mandatory CT and enforcement of CA Baseline Requirements by browsers is the immediate step. A decentralized trust model is the step after that. None of these steps require the USG to escrow our keys.
- zeveb 10y ago
  > Regarding your first point: no, they can't. See what happens if they try to exploit the DNS to get a Google certificate. (Notice the last several years of Google punishing CAs). If the U.S. government, or the Russian government, or the Luxembourgian government orders a CA subject to it to produce a certificate for a given key and hostname, it will be given a certificate for that key and hostname. If the U.S. government, or the Russian government, or the Luxembourgian government orders a DNS provider subject to it to resolve all requests for a domain to a different IP than it would have otherwise, those requests will be so resolved. If the U.S. government, or the Russian government, or the Luxembourgian government orders a network subject to it to route all traffic for one IP to a different IP it controls, that traffic will be so routed. > It is very important to DNSSEC advocates to convince people that our security can't be any better than the security of the .COM zone, which is controlled by the US Government through Verisign. But nobody accepts that level of security today. Everybody accepts that level of security today, because that's the level of security we have today. Actually, it's better than the level of security we have today, because at least a DNS-level CA system would mean that no-one other than someone who can compel .com can take over a .com hostname. Right now any government in the world can do so, at the drop of a hat. Restricting that to the government a company or person is subject to greatly reduces the attack surface.
  - tptacek 10y ago
    If the US government orders a CA to mint a bogus certificate for Google Mail, they will get the certificate, and then the CA will get put out of business, one way or the other. There are consequences to suborning the TLS CA system. DNSSEC advocates pretend there aren't, because they have to, or their arguments become untenable, because there cannot plausibly be similar consequences for suborning the DNS: we know for a fact, with repeated existence proofs, that governments will manipulate the DNS (like DOJ did with file sharing sites), and we know .COM isn't going anywhere. DNSSEC advocates will grudgingly acknowledge one half of the modern CA system security model: key continuity (pinning). What they seem unable to acknowledge is the other half. To use Moxie Marlinspike's terminology, which he coined in an argument against DNSSEC: trust agility.
    - 10y ago

tptacek 10y ago

Regarding your first point: no, they can't. See what happens if they try to exploit the DNS to get a Google certificate. (Notice the last several years of Google punishing CAs). It is very important to DNSSEC advocates to convince people that our security can't be any better than the security of the .COM zone, which is controlled by the US Government through Verisign. But nobody accepts that level of security today. Arguments that we can escrow all our security with Verisign are DOA, post Snowden. Move on. Regarding the rest: you can't persuasively rebut arguments by conceding they're correct.

garaetjjte 10y ago
> Regarding your first point: no, they can't. See what happens if they try to exploit the DNS to get a Google certificate. (Notice the last several years of Google punishing CAs). What? Article about it on HN? They won't punish CAs for that, because that won't be CA fault that USG modified DNS zone. > It is very important to DNSSEC advocates to convince people that our security can't be any better than the security of the .COM zone, which is controlled by the US Government through Verisign. But nobody accepts that level of security today. Arguments that we can escrow all our security with Verisign are DOA, post Snowden. Move on. Because it can't be better with DNS, which is by design hierarchical. You would have to create own domains as TLD in root zone. Oops, you now have to trust root zone owners! So you can create blockchain based domain system. But, it won't be DNS. And you will argue that implementing blockchain name system is even more expensive to implement than DNSSEC, because it is slow and requires big storage space. > Regarding the rest: you can't persuasively rebut arguments by conceding they're correct. Last mile problems aren't covered with DNSSEC, there is other RFC for that.
- tptacek 10y ago
  You've missed my point. The reason you can't DNS spoof to obtain a Google certificate is that the certificate is pinned, and CAs are monitored (through both pins and through CT). The rest of this comment continues to concede the arguments I made previously, but pretend that those concessions are rebuttals. It's really only in DNSSEC threads that I notice this peculiar rhetorical strategy deployed.
rocqua 10y ago
Sure, Google is defended, as are some other big sites. However, this isn't a scalable solution. Are you really going to argue that the sites small enough not to be statically pinned don't deserve to be safe from state-level attacks?
- tptacek 10y ago
  No? That's what HPKP does: it allows sites of any size to pin certificates.
  - rocqua 10y ago
    I'd say the article shows plenty of issues with HKPK. It also forgoes the fact that HKPK only works on the second visit.
    - tptacek 10y ago
      For that one user. But part of the point of HPKP is that it raises the stakes for CAs who would issue bogus certificates: someone will have their pin broken, browsers will notice, CAs will be forced into CT or worse.
      - rocqua 10y ago
        I have kinda lost faith in the stakes for CAs. It seems like they have to fuck over a really big client for anything to happen. In general, the CA system is fucked and we need a new one. Note that I never said DANE should be the replacement for CAs. Instead I wanted DANE pinnen to replace HPKP. I wonder if any if this is even relevant when you consider downgrade attacks.
        tptacek 10y ago
        Everyone has lost faith in the CA system. The problem is that DANE doubles down on it by creating a new hierarchical PKI, this time de jure controlled by governments. And it's not even a good PKI! It's a PKI built around 1990s cryptography. DANE is not the answer. Mandatory CT and enforcement of CA Baseline Requirements by browsers is the immediate step. A decentralized trust model is the step after that. None of these steps require the USG to escrow our keys.
zeveb 10y ago
> Regarding your first point: no, they can't. See what happens if they try to exploit the DNS to get a Google certificate. (Notice the last several years of Google punishing CAs). If the U.S. government, or the Russian government, or the Luxembourgian government orders a CA subject to it to produce a certificate for a given key and hostname, it will be given a certificate for that key and hostname. If the U.S. government, or the Russian government, or the Luxembourgian government orders a DNS provider subject to it to resolve all requests for a domain to a different IP than it would have otherwise, those requests will be so resolved. If the U.S. government, or the Russian government, or the Luxembourgian government orders a network subject to it to route all traffic for one IP to a different IP it controls, that traffic will be so routed. > It is very important to DNSSEC advocates to convince people that our security can't be any better than the security of the .COM zone, which is controlled by the US Government through Verisign. But nobody accepts that level of security today. Everybody accepts that level of security today, because that's the level of security we have today. Actually, it's better than the level of security we have today, because at least a DNS-level CA system would mean that no-one other than someone who can compel .com can take over a .com hostname. Right now any government in the world can do so, at the drop of a hat. Restricting that to the government a company or person is subject to greatly reduces the attack surface.
- tptacek 10y ago
  If the US government orders a CA to mint a bogus certificate for Google Mail, they will get the certificate, and then the CA will get put out of business, one way or the other. There are consequences to suborning the TLS CA system. DNSSEC advocates pretend there aren't, because they have to, or their arguments become untenable, because there cannot plausibly be similar consequences for suborning the DNS: we know for a fact, with repeated existence proofs, that governments will manipulate the DNS (like DOJ did with file sharing sites), and we know .COM isn't going anywhere. DNSSEC advocates will grudgingly acknowledge one half of the modern CA system security model: key continuity (pinning). What they seem unable to acknowledge is the other half. To use Moxie Marlinspike's terminology, which he coined in an argument against DNSSEC: trust agility.
  - 10y ago