4 ms·

Just migrate to DNSSEC/DANE already. CAs have no incentive to mis-issue certs. CAs whole business model is selling trust. Its obvious TLDs (.com/etc) are the on

Just migrate to DNSSEC/DANE already. CAs have no incentive to mis-issue certs. CAs whole business model is selling trust. Its obvious TLDs (.com/etc) are the one who should validate/issue certs. Regarding TLDs coming under control of Govts, Its solved by independent mirror nameservers run by app devs (Firefox/Chrome/etc) and NGOs (EFF/etc).

meta_AU 10y ago
Pitty DNSSEC has its own implementation issues.
tptacek 10y ago
There has never in the history of the Internet been a time when DNSSEC was less acceptable than it is today. People who don't know much about DNSSEC (reasonable, since nobody really deploys it, and it's a dying protocol) really only need to know one thing about it: it's a tree-structured PKI, just like the CA system, except that the top of the tree is run de jure by world governments. If DNSSEC had been deployed 10 years ago, Muammar Ghaddafi would have been BIT.LY's CA. https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/
- wav-part 10y ago
  > it's a tree-structured PKI, just like the CA system, except that the top of the tree is run de jure by world governments. Which can be solved by having bit.ly key validated by .ly key + Firefox key + LetsEncrypt key. DNSSEC may have other architectural/mplementational faults but this property is not one of them. I believe this way of certification is the way forword for internet scale web of trust.
  - tedunangst 10y ago
    That doesn't sound like much of a migration.
    - wav-part 10y ago
      Yes except it wont be the website server returning chain of trust but nameserver.
- wildfire 10y ago
  You do realise that the argument that that site is presenting is false. Firstly: "With TLS properly configured, DNSSEC adds nothing." DNSSEC presents you with a valid, secure chain to know that the meta-data (encoded as TLSA) about the end-point you intend to communicate with is valid. i.e. Grab the TLSA record for a hostname, validate the hostname (and TLSA record) via DNSSEC and then if the TLS certificate matches the details in the TLSA record you have confirmation that things are valid. Secondly: "Securing DNS lookups isn’t a high-priority". Then why there is a whole IETF WG dedicated to addressing it: https://datatracker.ietf.org/wg/dprive/about/ https://datatracker.ietf.org/wg/dprive/about/ Thirdly: "The real threat to CAs is “the global adversary” i.e. organisations like the NSA, GCHQ collating everything, everywhere. Any reasonable person could spend an afternoon - not being paid - providing a counterpoint to each item raised. None of them are (currently) relevant and the only one that is/was is actually being address in the IETF working group linked above.
  - tptacek 10y ago
    There's nothing in this comment that rebuts anything in "that site". Essentially, all you've managed to come up with is "it's wrong, because DNSSEC does what it does". I agree: DNSSEC does do what it does do. The problem is that what it does do isn't meaningful and doesn't add real security. At the same time, DANE/TLSA does create a system in which we replace certificate authorities with an organization run by the US Government.
- garaetjjte 10y ago
  Except that DNS TLDs are already run by world governments. Maybe you wanted to say that tree-structured DNS with TLDs owned by governments is bad, but this is a problem of DNS, not DNSSEC. DANE reduces parties able to issue rouge certificate from TLD owner + all CAs to TLD owner only.
  - tptacek 10y ago
    DNS TLDs are run by world governments. But the CA PKI is not. Restricting the ability to issue rogue certificates to world governments is not a win: in fact, it's a regression.
- amluto 10y ago
  Currently the DNS roots are already effectively in charge. If an entity, government or otherwise, controls .LY, they can trivially get a trusted X.509 cert for .LY. DANE just makes it much harder for other attackers to do the same. Having a CT-like feature for DNSSEC would be nice, though.
  - tptacek 10y ago
    That's clearly not true. Try this thought experiment: you're GCHQ, the owner of .IO. You want a certificate issued for GOOGLE.IO. You control the TLD and thus the GOOGLE.IO zone. What CA will issue you GOOGLE.IO on a DV basis, and what will happen if they do? Obviously, there's a reason nobody is issuing Google certificates, despite the insecure DNS that appears to be the only obstacle to that happening. Flesh out why, and try to be specific. The point isn't really about Google, but about the fact that the Web PKI is more complicated than the CA BRs suggest, and has safeguards at multiple levels. I am not arguing that the CA PKI is a good system. It is not. It's a wretched system. It's only my contention that DNSSEC is worse.
    - kodablah 10y ago
      I suppose the OP is assuming the government has a trusted root that they can create certs from at will. I would be curious to know, were a government able to DNS spoof or cert spoof to MITM traffic, which would they choose? Which would be more detectable? I assume Google is basically off limits without local machine access due to pinning and other checks built in to Chrome.
      - tptacek 10y ago
        Everyone assumes that each of the Five Eyes governments can, in a pinch, get any certificate they need issued. What people overlook is that on the modern Internet, browsers themselves form an ad hoc certificate surveillance network. If you get a certificate issued for a site that pins, or create a CT discrepancy, there is a very good chance Google and Mozilla are going to discover the CA responsible. And, as you can see, even if you operate the largest, most important CA on the Internet, Google will, if that happens, fuck your shit up. If you want one (of many) dispositive arguments against DNSSEC, just consider that Google and Apple and Mozilla are not in fact in a position to fuck shit up for .COM. You can't revoke or distrust a TLD: the use of those TLDs is encoded into the brains of hundreds of millions of users. Not so a CA!

meta_AU 10y ago

Pitty DNSSEC has its own implementation issues.

tptacek 10y ago

There has never in the history of the Internet been a time when DNSSEC was less acceptable than it is today. People who don't know much about DNSSEC (reasonable, since nobody really deploys it, and it's a dying protocol) really only need to know one thing about it: it's a tree-structured PKI, just like the CA system, except that the top of the tree is run de jure by world governments. If DNSSEC had been deployed 10 years ago, Muammar Ghaddafi would have been BIT.LY's CA. https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/

wav-part 10y ago
> it's a tree-structured PKI, just like the CA system, except that the top of the tree is run de jure by world governments. Which can be solved by having bit.ly key validated by .ly key + Firefox key + LetsEncrypt key. DNSSEC may have other architectural/mplementational faults but this property is not one of them. I believe this way of certification is the way forword for internet scale web of trust.
- tedunangst 10y ago
  That doesn't sound like much of a migration.
  - wav-part 10y ago
    Yes except it wont be the website server returning chain of trust but nameserver.
wildfire 10y ago
You do realise that the argument that that site is presenting is false. Firstly: "With TLS properly configured, DNSSEC adds nothing." DNSSEC presents you with a valid, secure chain to know that the meta-data (encoded as TLSA) about the end-point you intend to communicate with is valid. i.e. Grab the TLSA record for a hostname, validate the hostname (and TLSA record) via DNSSEC and then if the TLS certificate matches the details in the TLSA record you have confirmation that things are valid. Secondly: "Securing DNS lookups isn’t a high-priority". Then why there is a whole IETF WG dedicated to addressing it: https://datatracker.ietf.org/wg/dprive/about/ https://datatracker.ietf.org/wg/dprive/about/ Thirdly: "The real threat to CAs is “the global adversary” i.e. organisations like the NSA, GCHQ collating everything, everywhere. Any reasonable person could spend an afternoon - not being paid - providing a counterpoint to each item raised. None of them are (currently) relevant and the only one that is/was is actually being address in the IETF working group linked above.
- tptacek 10y ago
  There's nothing in this comment that rebuts anything in "that site". Essentially, all you've managed to come up with is "it's wrong, because DNSSEC does what it does". I agree: DNSSEC does do what it does do. The problem is that what it does do isn't meaningful and doesn't add real security. At the same time, DANE/TLSA does create a system in which we replace certificate authorities with an organization run by the US Government.
garaetjjte 10y ago
Except that DNS TLDs are already run by world governments. Maybe you wanted to say that tree-structured DNS with TLDs owned by governments is bad, but this is a problem of DNS, not DNSSEC. DANE reduces parties able to issue rouge certificate from TLD owner + all CAs to TLD owner only.
- tptacek 10y ago
  DNS TLDs are run by world governments. But the CA PKI is not. Restricting the ability to issue rogue certificates to world governments is not a win: in fact, it's a regression.
amluto 10y ago
Currently the DNS roots are already effectively in charge. If an entity, government or otherwise, controls .LY, they can trivially get a trusted X.509 cert for .LY. DANE just makes it much harder for other attackers to do the same. Having a CT-like feature for DNSSEC would be nice, though.
- tptacek 10y ago
  That's clearly not true. Try this thought experiment: you're GCHQ, the owner of .IO. You want a certificate issued for GOOGLE.IO. You control the TLD and thus the GOOGLE.IO zone. What CA will issue you GOOGLE.IO on a DV basis, and what will happen if they do? Obviously, there's a reason nobody is issuing Google certificates, despite the insecure DNS that appears to be the only obstacle to that happening. Flesh out why, and try to be specific. The point isn't really about Google, but about the fact that the Web PKI is more complicated than the CA BRs suggest, and has safeguards at multiple levels. I am not arguing that the CA PKI is a good system. It is not. It's a wretched system. It's only my contention that DNSSEC is worse.
  - kodablah 10y ago
    I suppose the OP is assuming the government has a trusted root that they can create certs from at will. I would be curious to know, were a government able to DNS spoof or cert spoof to MITM traffic, which would they choose? Which would be more detectable? I assume Google is basically off limits without local machine access due to pinning and other checks built in to Chrome.
    - tptacek 10y ago
      Everyone assumes that each of the Five Eyes governments can, in a pinch, get any certificate they need issued. What people overlook is that on the modern Internet, browsers themselves form an ad hoc certificate surveillance network. If you get a certificate issued for a site that pins, or create a CT discrepancy, there is a very good chance Google and Mozilla are going to discover the CA responsible. And, as you can see, even if you operate the largest, most important CA on the Internet, Google will, if that happens, fuck your shit up. If you want one (of many) dispositive arguments against DNSSEC, just consider that Google and Apple and Mozilla are not in fact in a position to fuck shit up for .COM. You can't revoke or distrust a TLD: the use of those TLDs is encoded into the brains of hundreds of millions of users. Not so a CA!