3 ms·

I wonder about the security of this kind of a solution, and how they'll respect/protect owned domain names. I'm assuming the idea of ownership of a domain name

I wonder about the security of this kind of a solution, and how they'll respect/protect owned domain names. I'm assuming the idea of ownership of a domain name becomes somewhat grey using this solution. For example, how will they protect against domain poisoning by someone hacking their client to send out fake entries which redirect a domain to something they own?

trickjarrett 16y ago
The problem of domain ownership was what jumped to my mind. How would the system protect from domain hijacking etc? The only system I can see has to do with polling multiple hosts, taking the most popular response for a domain and routing that way, but then it is still something that can be overcome with enough machines on the network.
- konad 16y ago
  Isn't that the same problem as downloading a torrent ?
  - khafra 16y ago
    Most people don't enter authentication credentials they use elsewhere or conduct financial transactions on torrented software, like they do on websites.
    - konad 16y ago
      I'm not going to be using my CC on a site designated a terrorist organisation by the US Govt. anyway. Using OpenAuth / OpenID / Facebook login etc. would mitigate the password problem.
- gst 16y ago
  I've posted some ideas here: http://news.ycombinator.com/item?id=1954992 http://news.ycombinator.com/item?id=1954992 The Bitcoin approach that I've mentioned looks basically like the following: Basically, you use Bitcoin's block chain described here: http://www.bitcoin.org/wiki/doku.php?id=block_chain http://www.bitcoin.org/wiki/doku.php?id=block_chain However, instead of using the chain for monetary transactions, you store new domain registrations in each individual block. Now you just need a mechanism to fend off the domain squatters. Again, we can use an approach similar to Bitcoin (and to Hashcash): If you want to store your registration in a block you need to "pay" for this with some CPU power. So if you want to register a given domain you need to calculate SHA-256(domainname + data), where data is chosen in a way that the first X bits of the resulting hash are zero. So basically you need to use a brute-force mechanism to find appropriate data. If it, e.g., takes on average 1 week to find this data, this is acceptable for an individual who wants to register a domain, but (hopefully) too expensive for a squatter. However one problem with this approach is that there's no incentive for someone to participate in the block generation. In bitcoin participation gives you Bitcoins which have a real monetary value. But I think creating some incentive shouldn't be too hard. E.g., it should be possible to couple the block chain to Bitcoin, so that generating blocks for the secure domain system also gives you Bitcoins (as a side effect).
  - mortimor 16y ago
    The incentive that has been proposed by BitDNS is that awarding blocks is equivalent to registering domains. So using the current protocol of awarding 50 bitcoins for every block generation would translate to awarding 50 name registrations. Plenty of incentive for early adopters to build a strong network.
    - narrator 16y ago
      You could also use bitcoins to buy access to restricted torrents and to get leach credit on p2p sites as well as to pay opennic dns providers.
SkyMarshal 16y ago
IANAE but I imagine domain verification will require a certain ratio of trackers to all point the domain at the same IP. Random poisoned trackers would be ignored, perhaps flagged. That still would leave the system vulnerable to massive botnets where a blackhat can 'flip a switch' and point a domain at a different IP on hundreds of thousands of nodes. It's an interesting idea and problem. The DNS system has always felt pseudo-distributed to me - not exactly centralized, but still limited in its redundancy. The idea of making a torrent-based DNS seems akin to a starfish - you can cut off every limb at the root and not only will it not die, it will completely regenerate.
aidenn0 16y ago
If they are distributing via the BT protocol, then each block will have a SHA-1 hash.
- tptacek 16y ago
  And?

trickjarrett 16y ago

The problem of domain ownership was what jumped to my mind. How would the system protect from domain hijacking etc? The only system I can see has to do with polling multiple hosts, taking the most popular response for a domain and routing that way, but then it is still something that can be overcome with enough machines on the network.

konad 16y ago
Isn't that the same problem as downloading a torrent ?
- khafra 16y ago
  Most people don't enter authentication credentials they use elsewhere or conduct financial transactions on torrented software, like they do on websites.
  - konad 16y ago
    I'm not going to be using my CC on a site designated a terrorist organisation by the US Govt. anyway. Using OpenAuth / OpenID / Facebook login etc. would mitigate the password problem.
gst 16y ago
I've posted some ideas here: http://news.ycombinator.com/item?id=1954992 http://news.ycombinator.com/item?id=1954992 The Bitcoin approach that I've mentioned looks basically like the following: Basically, you use Bitcoin's block chain described here: http://www.bitcoin.org/wiki/doku.php?id=block_chain http://www.bitcoin.org/wiki/doku.php?id=block_chain However, instead of using the chain for monetary transactions, you store new domain registrations in each individual block. Now you just need a mechanism to fend off the domain squatters. Again, we can use an approach similar to Bitcoin (and to Hashcash): If you want to store your registration in a block you need to "pay" for this with some CPU power. So if you want to register a given domain you need to calculate SHA-256(domainname + data), where data is chosen in a way that the first X bits of the resulting hash are zero. So basically you need to use a brute-force mechanism to find appropriate data. If it, e.g., takes on average 1 week to find this data, this is acceptable for an individual who wants to register a domain, but (hopefully) too expensive for a squatter. However one problem with this approach is that there's no incentive for someone to participate in the block generation. In bitcoin participation gives you Bitcoins which have a real monetary value. But I think creating some incentive shouldn't be too hard. E.g., it should be possible to couple the block chain to Bitcoin, so that generating blocks for the secure domain system also gives you Bitcoins (as a side effect).
- mortimor 16y ago
  The incentive that has been proposed by BitDNS is that awarding blocks is equivalent to registering domains. So using the current protocol of awarding 50 bitcoins for every block generation would translate to awarding 50 name registrations. Plenty of incentive for early adopters to build a strong network.
  - narrator 16y ago
    You could also use bitcoins to buy access to restricted torrents and to get leach credit on p2p sites as well as to pay opennic dns providers.

SkyMarshal 16y ago

IANAE but I imagine domain verification will require a certain ratio of trackers to all point the domain at the same IP. Random poisoned trackers would be ignored, perhaps flagged. That still would leave the system vulnerable to massive botnets where a blackhat can 'flip a switch' and point a domain at a different IP on hundreds of thousands of nodes. It's an interesting idea and problem. The DNS system has always felt pseudo-distributed to me - not exactly centralized, but still limited in its redundancy. The idea of making a torrent-based DNS seems akin to a starfish - you can cut off every limb at the root and not only will it not die, it will completely regenerate.

aidenn0 16y ago

If they are distributing via the BT protocol, then each block will have a SHA-1 hash.

tptacek 16y ago
And?