28 ms·

If you are relying on the CA system to secure your website, it is equally insecure no matter what TLD your site is under. DNSSEC at least gives you the possibi

If you are relying on the CA system to secure your website, it is equally insecure no matter what TLD your site is under. DNSSEC at least gives you the possibility of moving away from .COM, .ORG, etc to a top-level you trust. You still haven't said what your threat model is, though. The fact you mentioned "protection from governments" earlier suggests that the threat model you are envisaging is "I am trying to run a website that will be attacked by every country in the world". If that's your threat model, I would be interested to know what technology you suggest to counter that threat. Alternatively, if your threat model only includes "US, UK, Canada, or Australia" then there are various other TLDs that are more trustworthy than the Turkish or Chinese governments (no disrespect to those countries). For example, the TLDs of .ch, .dk, .li and .lu. Even .de and .fr should be managed in ways that are independent from the 5 Eyes.

tptacek 10y ago
I can't believe anyone thinks this is the Internet we should be forklifting the DNS out to build. The one where we have to decide which spy agency is going to escrow our TLS keys when we pick a domain name. It's the same day as the announcement of the Snowden pardon appeal drive, and we're saying "fuck it, all of .COM's TLS keys should just go straight to NSA". No. No no no.
- dane-pgp 10y ago
  Why are you so focused on "all of .COM's TLS keys" when, under the current CA system, all TLS keys for all domains go straight to NSA and any government that controls a CA (e.g. Turkey and China, etc.)? A situation where people can avoid the governments they don't trust is strictly better than this, but you seem to be arguing that it is strictly worse.
  - tptacek 10y ago
    Because: (a) They do not (go ahead and try to get a Google Mail cert). (b) They need not (CA's can be --- and have been --- and will probably within a few weeks be again --- untrusted by browsers) (c) It is insane --- as in, "definition of insanity" insane --- to double down on a hierarchical PKI controlled by governments as a response to problems with the CA system. It is literally the opposite of the direction we should (and are!) going in. I note: in no exchange we have ever had about this issue have you ever so much as rebutted my contention that adopting DNSSEC+DANE would escrow .COM TLS keys with the US government. That's unsurprising, because my contention is true. But I'd like to point it out anyways.
    - dane-pgp 10y ago
      (a) The fact that I can't (or won't) get a fake cert for Google Mail doesn't really prove anything. I am not the NSA. I assume you wouldn't accept the challenge if I asked you to produce a fake (but cryptographically valid) DNSSEC response for mail.google.com. (b) Waiting a few months after an attack for a CA to be shut down is not as much comfort as being able to choose in advance which ccTLD or gTLD you are under. As I keep saying, with DNSSEC, the malfeasance of a third party trust source has no effect on your security, unlike the existing case with CAs. (c) Switching from a "chain is as strong as its weakest link" model to one where you can be free from any subset of governments you choose is a strict improvement and very much the right direction to be going in. In response to your note: you have made many claims on this site, and I have rebutted those made in discussions I have been involved in, but I don't remember you making the "escrow" claim in one of the discussions I was involved in. I do remember seeing it recently, though, and laughing to myself about it, trying to work out what was going through your mind when you made that claim. Eventually I realised that by "escrow" you mean "The US government could force Verisign to issue a fake DNSSEC response for a website under .COM", i.e. a situation which is strictly better than "The US government could force Verisign to issue a fake TLS certificate for any website with any domain name." Presumably you would call that key escrow too. I hope I have understood you correctly, and that this counts as a rebuttal, but it's 03:30 here so I'll have to leave this interesting discussion for the night. I look forward to hearing what you have to say in this or another thread soon.
      - tptacek 10y ago
        In a DANE world, every TLS certificate for a site under .COM is validated through the DNS, and the USG, which controls the DNS for .COM, can silently swap in its own identity for that of any of those sites. They don't get the bits of your private key exponent. They don't need them; the DNSSEC key escrow system is subtle enough to let people think their secret keys matter.
        dane-pgp 10y ago
        In a CA world, every TLS certificate for a site under . is validated through trusting the CA, and the USG, which controls various CAs capable of issuing certificates for any site, can silently swap in its own identity for that of any of those sites. They don't get the bits of your private key exponent. They don't need them; the CA key escrow system is subtle enough to let people think their secret keys matter.

tptacek 10y ago

I can't believe anyone thinks this is the Internet we should be forklifting the DNS out to build. The one where we have to decide which spy agency is going to escrow our TLS keys when we pick a domain name. It's the same day as the announcement of the Snowden pardon appeal drive, and we're saying "fuck it, all of .COM's TLS keys should just go straight to NSA". No. No no no.

dane-pgp 10y ago
Why are you so focused on "all of .COM's TLS keys" when, under the current CA system, all TLS keys for all domains go straight to NSA and any government that controls a CA (e.g. Turkey and China, etc.)? A situation where people can avoid the governments they don't trust is strictly better than this, but you seem to be arguing that it is strictly worse.
- tptacek 10y ago
  Because: (a) They do not (go ahead and try to get a Google Mail cert). (b) They need not (CA's can be --- and have been --- and will probably within a few weeks be again --- untrusted by browsers) (c) It is insane --- as in, "definition of insanity" insane --- to double down on a hierarchical PKI controlled by governments as a response to problems with the CA system. It is literally the opposite of the direction we should (and are!) going in. I note: in no exchange we have ever had about this issue have you ever so much as rebutted my contention that adopting DNSSEC+DANE would escrow .COM TLS keys with the US government. That's unsurprising, because my contention is true. But I'd like to point it out anyways.
  - dane-pgp 10y ago
    (a) The fact that I can't (or won't) get a fake cert for Google Mail doesn't really prove anything. I am not the NSA. I assume you wouldn't accept the challenge if I asked you to produce a fake (but cryptographically valid) DNSSEC response for mail.google.com. (b) Waiting a few months after an attack for a CA to be shut down is not as much comfort as being able to choose in advance which ccTLD or gTLD you are under. As I keep saying, with DNSSEC, the malfeasance of a third party trust source has no effect on your security, unlike the existing case with CAs. (c) Switching from a "chain is as strong as its weakest link" model to one where you can be free from any subset of governments you choose is a strict improvement and very much the right direction to be going in. In response to your note: you have made many claims on this site, and I have rebutted those made in discussions I have been involved in, but I don't remember you making the "escrow" claim in one of the discussions I was involved in. I do remember seeing it recently, though, and laughing to myself about it, trying to work out what was going through your mind when you made that claim. Eventually I realised that by "escrow" you mean "The US government could force Verisign to issue a fake DNSSEC response for a website under .COM", i.e. a situation which is strictly better than "The US government could force Verisign to issue a fake TLS certificate for any website with any domain name." Presumably you would call that key escrow too. I hope I have understood you correctly, and that this counts as a rebuttal, but it's 03:30 here so I'll have to leave this interesting discussion for the night. I look forward to hearing what you have to say in this or another thread soon.
    - tptacek 10y ago
      In a DANE world, every TLS certificate for a site under .COM is validated through the DNS, and the USG, which controls the DNS for .COM, can silently swap in its own identity for that of any of those sites. They don't get the bits of your private key exponent. They don't need them; the DNSSEC key escrow system is subtle enough to let people think their secret keys matter.
      - dane-pgp 10y ago
        In a CA world, every TLS certificate for a site under . is validated through trusting the CA, and the USG, which controls various CAs capable of issuing certificates for any site, can silently swap in its own identity for that of any of those sites. They don't get the bits of your private key exponent. They don't need them; the CA key escrow system is subtle enough to let people think their secret keys matter.