3 ms·
> As long as DNS is insecure, Security Services can intercept and reroute IP addresses (...) > (...) but who knows what secure websites are signed by Digicert
by Leace 8y ago
> As long as DNS is insecure, Security Services can intercept and reroute IP addresses (...)
> (...) but who knows what secure websites are signed by Digicert or some other CA?
Well, what would be that "secure DNS" in your opinion?
If you assume someone can subvert Digicert would they be able to subvert that "secure DNS" too?
- skywhopper 8y agoFWIW, this is the attack that DNSSEC is meant to prevent.
- Leace 8y agoNot if "someone [who] can subvert Digicert" is government/state. In this case they have an easier task as governments directly control DNSSEC signing keys, and subverting Digicert and issuing rogue certs would be visible in Certificate Transparency logs.
- dane-pgp 8y agoGovernments directly control the DNSSEC signing keys for their ccTLDs, but at best indirectly control DNSSEC signing keys for some gTLDs. The US government could, for example, use some legal instrument to compel a US-based CA to issue a certificate for an arbitrary domain, and similarly compel a US company like Verisign (who manage the .com gTLD) to change the DNSSEC records for a .com address. The big differences are 1) you can choose a domain under a gTLD that isn't run by an American company (or other country that is part of your threat model), 2) you can choose to run your own gTLD (at a certain cost), 3) admittedly Certificate Transparency for CAs is much further along than CT for DNSSEC, you're right. https://tools.ietf.org/html/draft-zhang-trans-ct-dnssec-03 https://tools.ietf.org/html/draft-zhang-trans-ct-dnssec-03
- tptacek 8y agoI don't understand how people make this argument with a straight face. Google cannot simply abandon .COM. The most commercially important domains in the western world are all controlled by Five Eyes governments.
- dane-pgp 8y agoGoogle already do abandon .com for localised search in individual countries, and most people aren't actually typing "google.com" to find the search engine (it's probably a browser setting). Also, I don't understand how you can pick Google as an example with a straight face. The most commercially important websites in the western world are all run by companies that are controlled by Five Eyes governments.
- tptacek 8y agoIf you think "give up on .COM, .NET, .ORG, .UK, .IO, .CA, .AU, and .NZ" is a reasonable response to this problem, why stop there? Virtually everyone agrees DNSSEC isn't a great protocol; had it been designed in 2010 rather than in 1994, it would for instance take advantage of online-signing, like every modern cryptosystem does. Why not just go all the way to something like NameCoin? You've already given up on, basically, "the Internet" as people know it. I'm not even opposed to that! (I'm not a fan of NameCoin, or any-coin at all, but whatever). I just think, be coherent about things.
- dane-pgp 8y agoIf your threat model includes the threat that Five Eyes governments will try to (legally, or otherwise) commandeer the DNSSEC infrastructure (and, more easily, the CA system) to actively attack users accessing your server, then it is perfectly reasonable to "give up on .COM, .NET, .ORG, .UK, .IO, .CA, .AU, and .NZ". Under such a threat model it would also be prudent to never visit a Five Eyes country, or hold any assets there. Depending on your use case, a better approach might be to host your server in the Tor network, in which case NameCoin would indeed make some sense: https://www.namecoin.org/2017/06/22/tor-prop279-release.html https://www.namecoin.org/2017/06/22/tor-prop279-release.html