28 ms·

I don't understand this US government nonsense and why it continues to persist. Will someone please explain to me like I'm 5 why you are trusting the US governm

I don't understand this US government nonsense and why it continues to persist. Will someone please explain to me like I'm 5 why you are trusting the US government if you deploy DNSSEC? Where in the trust chain of the .com zone does the USG come into play?

rocqua 9y ago
The .com domain is controlled by the USG. If they want to serve a false DNS response, they can access the key used to sign the .com domain. That key can be used to sign a new key for the relevant domain, which can be used to sign the response. That the .com domain is under USG controll follows from: "The domain was originally administered by the United States Department of Defense, but is today operated by Verisign, and remains under ultimate jurisdiction of U.S. law."[1] That said, since the control was transfered away from the DoD, the control is much less. A similar argument still holds for country level TLDs. Any government that administers its own TLD can use that with DNSSEC to forge DNS responses. [1] https://en.wikipedia.org/wiki/.com https://en.wikipedia.org/wiki/.com
- AndyMcConachie 9y ago
  Verisign is just a company located in the USA. Does it then follow that any company located in the USA is 'controlled by the USG'? That seems like a bit of a stretch, to say the least. There is nothing else there. Your reference to history is irrelevant today. Also, I really don't understand what this has to do with DNSSEC? Without DNSSEC anyone can forge responses. With DNSSEC you limit that to the zone administrator.
  - rocqua 9y ago
    > Without DNSSEC anyone can forge responses. With DNSSEC you limit that to the zone administrator. Whilst that is an improvement, it is still bad. Specifically, I'd it is not good enough to build a secure system on. There is an argument to be made that it is nice for defense in depth, but it should not be stand-alone security. There are other practical concerns regarding DNSSEC at the moment with failure handling.
  - Panino 9y ago
    > Verisign is just a company located in the USA. Does it then follow that any company located in the USA is 'controlled by the USG'? Verisign doesn't own .com -- the US government does. Verisign operates .com on contract with the US Chamber of Commerce.

rocqua 9y ago

The .com domain is controlled by the USG. If they want to serve a false DNS response, they can access the key used to sign the .com domain. That key can be used to sign a new key for the relevant domain, which can be used to sign the response. That the .com domain is under USG controll follows from: "The domain was originally administered by the United States Department of Defense, but is today operated by Verisign, and remains under ultimate jurisdiction of U.S. law."[1] That said, since the control was transfered away from the DoD, the control is much less. A similar argument still holds for country level TLDs. Any government that administers its own TLD can use that with DNSSEC to forge DNS responses. [1] https://en.wikipedia.org/wiki/.com https://en.wikipedia.org/wiki/.com

AndyMcConachie 9y ago
Verisign is just a company located in the USA. Does it then follow that any company located in the USA is 'controlled by the USG'? That seems like a bit of a stretch, to say the least. There is nothing else there. Your reference to history is irrelevant today. Also, I really don't understand what this has to do with DNSSEC? Without DNSSEC anyone can forge responses. With DNSSEC you limit that to the zone administrator.
- rocqua 9y ago
  > Without DNSSEC anyone can forge responses. With DNSSEC you limit that to the zone administrator. Whilst that is an improvement, it is still bad. Specifically, I'd it is not good enough to build a secure system on. There is an argument to be made that it is nice for defense in depth, but it should not be stand-alone security. There are other practical concerns regarding DNSSEC at the moment with failure handling.
- Panino 9y ago
  > Verisign is just a company located in the USA. Does it then follow that any company located in the USA is 'controlled by the USG'? Verisign doesn't own .com -- the US government does. Verisign operates .com on contract with the US Chamber of Commerce.