5 ms·
If true it means that Cloudflare's DNS server can't be trusted.
by jpollock 8y ago
If true it means that Cloudflare's DNS server can't be trusted.
- ancarda 8y agoDo you mean it can't ever be trusted? Or just right now? BGP hijacking isn't that difficult to pull off. I hope you're not trusting 8.8.8.8 either: https://twitter.com/bgpmon/status/445266642616868864 https://twitter.com/bgpmon/status/445266642616868864
- Latteland 8y agoThat's not correct, anyone could 'accidentally' do this to every other provider. It's not a special weakness of cloudflare.
- jpollock 8y agoI'm sorry, I went for brevity because someone was asking for possible impacts. If I were using 1.1.1.1 as a DNS server and saw this news story, I would change to a different DNS server until the problem was resolved. My goal was to provide actionable information quickly. I never said it was specific to Cloudflare. :) It is specifically a mistake which would break an assumption - that putting 1.1.1.1 into your resolver results in an answer from Cloudflare. DNS doesn't necessarily have any protections (not current, so maybe they were added?), so the only level of protection is that the IP address routes UDP traffic where we expect it to. It also isn't a long-term problem, it only remains for the length of time the route is wrong. It could also be argued that we're already trusting every router between the device and 1.1.1.1 anyways, so there's not much difference. Except that there's already a trust relationship between those groups, and the new route subverts them. It's the same level of risk if someone had done a BGP hijack of any backbone router.