6 ms·
At the moment, DNSSEC is the only off-the-shelf authenticated DNS system. We need that authentication between the DNS servers and the Certificate Authorities. D
by btilly 8y ago
At the moment, DNSSEC is the only off-the-shelf authenticated DNS system. We need that authentication between the DNS servers and the Certificate Authorities. DNSSEC between the DNS server and hosts doesn't matter much. There are other ways to MitM, and insecure fallback is inevitable.
Your reasoning is of the form, "We need something. This is something. Therefore we need this."
No, actually we don't. We don't need this unless we can demonstrate that it makes things better in the real world, with real problems that people really encounter.
The problem isn't simply that it fails to protect against DNS account hijacking. The problem is that it makes the common problem of DNS account hijacking even worse than it is now. Which means that it makes an existing problem bigger than it is now.
Yes, it also solves another problem. But now we have to look at it as a tradeoff between two problems, decide which is worse, and decide accordingly. Every security professional and network admin that I trust finds the tradeoff obvious, and not in DNSSEC's favor.
- dbrgn 8y agoTo give an example of how things get better in the real world: Let's Encrypt won't issue a certificate if your DNSSEC records are invalid.
- rocqua 8y agoSadly, if you can spoof DNS replies, you can probably strip the DNSSEC records. You need fail-closed systems for security, but fail-closed systems are not user friendly, and thus won't be accepted.
- Ajedi32 8y ago> if you can spoof DNS replies, you can probably strip the DNSSEC records You can't. DNSSEC has explicit protections against that.
- rocqua 8y agoThose don't work if you claim to be a non DNSSEC compliant resolver. Should clients really fail closed when faced with a non DNSSEC resolver they got from e.g. the starbucks WiFi DHCP? And if they should, do you really think they will? Because users will complain loudly.
- Ajedi32 8y agoClients, no. Certificate Authorities like Let's Encrypt, yes. (And in fact, they already do behave that way.)
- rocqua 8y ago> Your reasoning is of the form, "We need something. This is something. Therefore we need this." Pretty much, though I would rephrase it to: X seems useful, Y is the only realistic way to get X soon, so Y has a valid use case. Notably, tptaeck mentioned RDAP which might make "Y is the only realistic way to get X soon" wrong.