4 ms·
nice toy, but there are some things to be considered: 1) "secure DNS" is a solved problem 2) DNS is simple 3) responses normally easily fit inside one packet 4
by KaiserPro 10y ago
nice toy, but there are some things to be considered:
1) "secure DNS" is a solved problem
2) DNS is simple
3) responses normally easily fit inside one packet
4) DNS is fast
HTTPS is a slow, wordy and inefficient protocol. Forcing everything into JSON just compounds the problem.
- strictfp 10y ago"nice toy". Very succinct diss.
- viraptor 10y ago> 1) "secure DNS" is a solved problem No, not in practice. You can easily MitM DNS and nobody is verifying DNSSEC by default. On the current internet, secure DNS just doesn't exist.
- KaiserPro 10y agothe mechanism is there, people are not choosing to use it. That is because security is hard. This doesn't mitigate MitM attacks, as upstream DNS records can still be spoofed WE go from a fast, decentralised, resilient and low overhead system, to a centralised chatty and fragile behemoth. It still doesn't give end to end encryption, its just a slow encrypted proxy.
- viraptor 10y agoFirst people need to know about it to use it. Then it needs to actually work and not fail. https://ianix.com/pub/dnssec-outages.html https://ianix.com/pub/dnssec-outages.html
- sashametro 10y agoGoogle Public DNS (8.8.8.8) verifies DNSSEC by default. So does Verisign Public DNS (64.6.64.6). Some measurements of DNSSEC validation show that as much as 15% of Internet domain lookups validate DNSSEC: http://stats.labs.apnic.net/dnssec/XA http://stats.labs.apnic.net/dnssec/XA. Approximately half of that is due to Google Public DNS validation (many sites use both Google Public DNS and other resolvers that do not validate, so do not actually validate DNSSEC overall). It is very true that less than 1% of DNS zones are signed with DNSSEC, so it is true that "secure DNS" doesn't practically exist, but this a serving side issue, not a lack of client validation.