5 ms·

Those are like hipster reasons to not like DNSSEC! DNSSEC is just dumb and doesn't work. [ User ] <-----> [ Resolver ] <-----> [ Auth DNS ] ^

Those are like hipster reasons to not like DNSSEC! DNSSEC is just dumb and doesn't work. [ User ] <-----> [ Resolver ] <-----> [ Auth DNS ] ^ ^ Most attacks work here DNSSEC protects here

jopsen 9y ago
Presumably advanced users can pick a resolver with DNSSEC support?
- aaronmdjones 9y ago
  You mean the resolver does the verifying? That doesn't solve anything; anyone doing an MITM attack between the user and their resolver can flip the 'ad' (Authenticated Data) bit to '1' even if the verification failed, and if the user isn't verifying the signatures too, they will blindly trust the value of this bit. Users need to run their own local /verifying/ resolvers for this to be secure (or have a trusted path between them and their remote resolver, e.g. IPsec-AH or DNScrypt).
jcranmer 9y ago
Actually, that's not where most attacks work. Most attacks rely on people thinking that google.com.please.dont.read.this.part.of.the.domain.evil.com is really google.com.
- tptacek 9y ago
  He meant most DNS attacks. DNSSEC does nothing about the *.domain.evil.com attack.
bluejekyll 9y ago
(throws caution to the wind...) DNSSec is not dumb. The gap you're pointing out is valid for most standard user OS's that are not performing DNSSec validation and/or are not using private/secure/authenticated channels to their upstream resolver. DNSCrypt and DNS over TLS solve the later. But, there's no reason that users can't run validating Resolvers locally as well, thus filling in the gap you point out. Now, most users and OS' out there don't provide these capabilities, so the gap you point out is 100% accurate based on the current state of the world. But, shouldn't we fix this and start bringing the validation to the end user OS'? tptacek's criticism's are more on point, b/c they get to the heart of some issues in the deployment and actual security of the DNSSec network, and these are foundational issues that we need to resolve. I'm optimistic that we can solve them and I don't think we should give up just b/c it's non-ideal today.
deleted 9y ago
[deleted]

Those are like hipster reasons to not like DNSSEC! DNSSEC is just dumb and doesn't work. [ User ] <-----> [ Resolver ] <-----> [ Auth DNS ] ^ ^ Most attacks work here DNSSEC protects here

jopsen 9y ago

Presumably advanced users can pick a resolver with DNSSEC support?

aaronmdjones 9y ago
You mean the resolver does the verifying? That doesn't solve anything; anyone doing an MITM attack between the user and their resolver can flip the 'ad' (Authenticated Data) bit to '1' even if the verification failed, and if the user isn't verifying the signatures too, they will blindly trust the value of this bit. Users need to run their own local /verifying/ resolvers for this to be secure (or have a trusted path between them and their remote resolver, e.g. IPsec-AH or DNScrypt).

jcranmer 9y ago

Actually, that's not where most attacks work. Most attacks rely on people thinking that google.com.please.dont.read.this.part.of.the.domain.evil.com is really google.com.

tptacek 9y ago
He meant most DNS attacks. DNSSEC does nothing about the *.domain.evil.com attack.

bluejekyll 9y ago

(throws caution to the wind...) DNSSec is not dumb. The gap you're pointing out is valid for most standard user OS's that are not performing DNSSec validation and/or are not using private/secure/authenticated channels to their upstream resolver. DNSCrypt and DNS over TLS solve the later. But, there's no reason that users can't run validating Resolvers locally as well, thus filling in the gap you point out. Now, most users and OS' out there don't provide these capabilities, so the gap you point out is 100% accurate based on the current state of the world. But, shouldn't we fix this and start bringing the validation to the end user OS'? tptacek's criticism's are more on point, b/c they get to the heart of some issues in the deployment and actual security of the DNSSec network, and these are foundational issues that we need to resolve. I'm optimistic that we can solve them and I don't think we should give up just b/c it's non-ideal today.

deleted 9y ago

[deleted]