4 ms·

( serious question - I might not know something ) If I run my own resolver, with a hardcoded [1] trust anchor, how could an ISP affect me regardless of what fu

( serious question - I might not know something ) If I run my own resolver, with a hardcoded [1] trust anchor, how could an ISP affect me regardless of what funny things it does with my DNS traffic...? [1] https://sources.debian.net/src/bind9/1:9.10.3.dfsg.P4-10.1/bind.keys/#L35-L45 https://sources.debian.net/src/bind9/1:9.10.3.dfsg.P4-10.1/b...

lmns 10y ago
It'll just break and you won't have a working DNS.
hannob 10y ago
Well, the traffic is not encrypted or otherwise protected, so a firewall trying to be "smart" could do all kinds of things. E.g. not letting you connect to other DNS servers at all or filtering all queries with unusual record types.
- ribasushi 10y ago
  But the point of DNSSEC isn't to protect your ability to contact another server, just like the point of SSL isn't to be a substitute for TOR. Are we on the same page that with DNSSEC activated on a local resolver one would either get an authentic answer, or nothing at all?
  - hannob 10y ago
    > Are we on the same page that with DNSSEC activated on a local resolver one would either get an authentic answer, or nothing at all? Sure. But it's not very relevant, because almost nobody does that. And that's unlikely to change, because getting nothing at all isn't a very desirable state of affairs. And given that forcing local DNSSEC resolvers in an OS or a browser would likely mean that a large share of your userbase will get nothing at all this is pretty much impractial.
    - ribasushi 10y ago
      > And that's unlikely to change, because getting nothing at all isn't a very desirable state of affairs. It worked for HTTPS - more and more browser builds refuse to show you stuff, with no workaround, even if there is nothing wrong with the certificates ( cough-sha1-cough-or-cough-chrome-cert-transparency-cough ). Yet I don't see any users revolt. Claiming that having an all-or-nothing HTTPS is a-ok, yet having all-or-nothing DNS is unacceptable is... inconsistent.
  - danyork 10y ago
    Correct. And if the local resolver is sufficiently close to your client that there is very low risk of an attacker getting into your local network, then you can have a higher degree of trust in those validated answers from your resolver.

lmns 10y ago

It'll just break and you won't have a working DNS.

hannob 10y ago

Well, the traffic is not encrypted or otherwise protected, so a firewall trying to be "smart" could do all kinds of things. E.g. not letting you connect to other DNS servers at all or filtering all queries with unusual record types.

ribasushi 10y ago
But the point of DNSSEC isn't to protect your ability to contact another server, just like the point of SSL isn't to be a substitute for TOR. Are we on the same page that with DNSSEC activated on a local resolver one would either get an authentic answer, or nothing at all?
- hannob 10y ago
  > Are we on the same page that with DNSSEC activated on a local resolver one would either get an authentic answer, or nothing at all? Sure. But it's not very relevant, because almost nobody does that. And that's unlikely to change, because getting nothing at all isn't a very desirable state of affairs. And given that forcing local DNSSEC resolvers in an OS or a browser would likely mean that a large share of your userbase will get nothing at all this is pretty much impractial.
  - ribasushi 10y ago
    > And that's unlikely to change, because getting nothing at all isn't a very desirable state of affairs. It worked for HTTPS - more and more browser builds refuse to show you stuff, with no workaround, even if there is nothing wrong with the certificates ( cough-sha1-cough-or-cough-chrome-cert-transparency-cough ). Yet I don't see any users revolt. Claiming that having an all-or-nothing HTTPS is a-ok, yet having all-or-nothing DNS is unacceptable is... inconsistent.
- danyork 10y ago
  Correct. And if the local resolver is sufficiently close to your client that there is very low risk of an attacker getting into your local network, then you can have a higher degree of trust in those validated answers from your resolver.