4 ms·
I did see Colm's Tweet last week. I'm just not sure what the attacker gains from the lockout being cryptographic, as opposed to being based on old-fashioned DNS
by agwa 8y ago
I did see Colm's Tweet last week. I'm just not sure what the attacker gains from the lockout being cryptographic, as opposed to being based on old-fashioned DNS caching. If the attacker gets an A record pointing to a bogus IP address cached in a bunch of places, that's just as bad as getting a bogus DNSSEC key cached - either way, users are locked out until the malicious records expire at their resolvers.
DNSSEC makes many things worse, but I don't think this is one.
- tptacek 8y agoYeah, I feel like Paul Wouters also shot this scenario down pretty conclusively, but I'm sort of doing my best to reconstruct what colmmac was talking about and might not be doing the best job of it.
- geofft 8y agoAha, I think I saw that tweet too and that's where this idea got into my head. I don't know much about the low-level details of DNSSEC so please just ignore that part :)