3 ms·
The reason DNSSEC is vulnerable to that kind of MITM attack is because browsers refuse to do client side validation. For privacy reasons, DNS over TLS and DNS
by phicoh 8y ago
The reason DNSSEC is vulnerable to that kind of MITM attack is because browsers refuse to do client side validation.
For privacy reasons, DNS over TLS and DNS over HTTPS are still a good idea. So even with DNSSEC you would need one of those.
- tptacek 8y agoBrowsers tried to do DNSSEC validation. It didn't work. DNSSEC features in Chrome, OS X, and Firefox were rolled back. Also: it is part of the architecture of DNSSEC for clients not to do full validation, which requires that they act as their own recursive resolvers and eliminates shared caches.
- phicoh 8y agoAny pointers to which browser versions did do DNSSEC validation and is there any documentation of what didn't work? My experience with running the validator plugin for a couple of years is that it just works. Obviously, in the early days of DNSSEC there were more improperly signed zones. But since Google's public resolvers do DNSSEC validation, that is mostly a thing of the past. Then there might be the rare case of middle boxes breaking DNSSEC, but as far as I can tell, that is extremely rare. There is no connection between DNSSEC validation and being a full recursive resolver. You can easily have a stub resolver that does DNSSEC validation. Or, if it is easier, have a local validation recursive resolver that forwards to another recursive resolver.
- tptacek 8y agoGoogle [why not dane in browsers].
- phicoh 8y agoI'm sure you are aware that Google has different results for different people. So for me the first 10 hits: don't seem to include any reference to browser versions that did DNSSEC validation. And didn't have any reference to studies using those browser versions to see what breaks. In short, 'Just google it' often means that somebody doesn't actually have the relevant references.