7 ms·
As a total outsider, what is wrong with DNSSEC? Security extensions seem like a good idea, to the uninitiated. Are there any relevant links I should read?
by hazz99 8y ago
As a total outsider, what is wrong with DNSSEC? Security extensions seem like a good idea, to the uninitiated. Are there any relevant links I should read?
- Abekkus 8y agoIf Thomas isn't responding I will. DNSSEC is an important idea, but not something a company's security department should be terribly worried about implementing just this minute. TLS will take care of most of what you need in that area. The most practical concern right now is that DNSSEC isn't even being honored by most clients, so even if you build a solution that you're comfortable with, it will be doing nothing to secure most of your customers' connections. If clients start using DNSSEC more in the future, you'll hear about it.
- pvg 8y agoA big part of his argument is that it's not, in fact, an important idea.
- Abekkus 8y agoCalling DNSSEC "worse than nothing" is the part where he overreaches, doesn't engage with valid counterarguments, and just calls his objectors Linux nerds, or true believers; yet he still gets upvoted by some quiet army.
- pvg 8y agohttps://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/
- auslander 8y agoWhat a rubbish.
- __Joker 8y agoNoob here, when it comes to security and dnssec. Can you provide some information why the article is bad or some other source ? Nothing but for learning purpose.
- auslander 8y agoLook at headers. Highly opnionated, not a single pro statement. A good paper discusses all sides of a subject, no cherry picking. For info, wikipedia is a very good starting resource.
- pvg 8y agoA good paper discusses all sides of a subject Not really. There's plenty of good technical and other writing that is one-sided and opinionated, those things are orthogonal to accuracy and quality. It says 'Against DNSSEC' right on the tin.
- auslander 8y ago> good technical and other writing that is one sided and opinionated https://en.m.wikipedia.org/wiki/Scientific_method https://en.m.wikipedia.org/wiki/Scientific_method
- bluejekyll 8y agoRather than talking about what’s wrong with DNSSEC, let’s focus on what it’s intended to do for security. DNSSEC is a set of related DNS record types that allow zones to sign individual records with a key, and chain that back to parent zones. In practice, this looks very much like X509 certificate chains, if you’re familiar with those. The intention is to authenticate all data in the DNS graph with the root zones being signed by a root key, and then every sub-zone signing itself and all other sub-zones until you reach the leaf records signed by the current zones DNSKEY. Many people take issue with the fact that the root key is a single, long-lived, somewhat weak RSA key, that could be compromised. The general argument is that X509 with TLS is enough authentication of a site one is connecting to, and therefor DNSSEC being somewhat weak, is something unnecessary.
- tptacek 8y agoThe bigger issue is that it adds to the ~50-odd CAs we're required to trust a collection of new CAs --- the owners of commercially relevant TLDs --- who, unlike existing CAs, we can't just kill when we detect misbehavior.
- teddyh 8y agoX.509 CA’s are problematic precisely because any one of them, no matter how sketchy, can issue certificates for any name. DNSSEC does not have that problem: TLD’s in DNSSEC are restricted to their TLD, and you can decide yourself if you trust the domains in the hypothetical “.sketchy” TLD to be properly DNSSEC signed.
- tptacek 8y agoAnd every one of them can be monitored and will be killed if they mis-issue. If Google can kill Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL, what hope does some random small CA have? The same thing is absolutely not the case of TLD owners. There is no mechanism at all to "revoke" them. You can't "distrust" them without the entire TLD vanishing from the Internet.