4 ms·
I get it, it’s cool to shit on DNSSEC. But let’s talk about defense in depth. The way you solve account hijacking is two fold. First: authenticate records. Seco
by dcow 8y ago
I get it, it’s cool to shit on DNSSEC. But let’s talk about defense in depth. The way you solve account hijacking is two fold. First: authenticate records. Second: don’t trust registrars to produce the contents of records. Reduce registrars to a simple ledger indicating which key to trust for a domain along with the length of the lease. Make people take care of their keys. If a registrar does offer to sign records on an owner’s behalf, maybe don’t use it for security critical services like email.
I don’t think the desire to authenticate data coming from the internet’s global public key-value store is ludicrous.
- icebraining 8y agoHow does (2) solve the problem? Why wouldn't the attacker just replace the key with their own?
- dcow 8y agoTo do so they would have to pop the registrar's account/service, not an individual domain owner's.
- icebraining 8y agoHow does the registrar know which key to trust? There must be some way for the domain owner to indicate their key, and to replace it if they lose it; essentially, a website where you login and upload your key, much like you currently login and configure your records.
- tptacek 8y agoEvery useless security product ever pitched has justified its existence with "defense in depth".
- eitland 8y ago> Every useless security product ever pitched has justified its existence with "defense in depth". Even if this is true it is also shallow, misleading and IMO more of a master suppression technique[0]: even if we accept it as true it doesn't mean the opposite is true (i.e. that everything that is marketed as "defence in depth" is a useless security product. [0]: https://en.wikipedia.org/wiki/Master_suppression_techniques https://en.wikipedia.org/wiki/Master_suppression_techniques
- tptacek 8y agoYou're rebutting an argument that I didn't make. What I said was that "defense in depth" is a weak argument. I didn't say that any solution that invokes "defense in depth" is bad. DNSSEC is bad on its own merits.
- dcow 8y agoLet's just secure the perimeter and live in a world of VPNs and negligently open hosts. I'm not strictly arguing that DNSSEC is a good thing. But I do think it makes sense to authenticate data flowing across general networks, no? You're saying the problem isn't a problem because part of the solution is stupid today. I guess it's job security for security professionals to have insecure things floating around that need additional security? At least some people want to solve the problem. The internet as it exists today being engineered around insecure DNS is not a feature. Name one other scenario where there's a preference for no security. People used to say the same thing about the boot process. Now we have secure boot. Maybe that's just stupid too but I feel a lot better knowing that my hardware is booting verified images than whatever happens to be sitting at some address in unprotected memory (as long as I remain the owner of the key).
- tptacek 8y agoLet's not have negligently open hosts or DNSSEC. In fact: that's pretty much what competent operators do today. See! No changes needed.