4 ms·

So I'm going to let someone inject DNS entries into a local /etc/hosts hijack, based on information from a 3rd party over a distributed network? You know, I'm

by buro9 16y ago

So I'm going to let someone inject DNS entries into a local /etc/hosts hijack, based on information from a 3rd party over a distributed network? You know, I'm not actually against that so long as I can verify the end site in some way. Perhaps all traffic over this .p2p network should be SSL? And perhaps someone somewhere can hold a verifiable list of certs. Basically, who in this arrangement can I trust to route my request to the right site? How do I know they won't lie? I know that applies now too, but DNS is based on trust and that generally means the roots are trusted and they won't risk that trust. In this decentralised world, who can be trusted?

storborg 16y ago
The local application would ensure that only .p2p DNS requests would get handled by this system. Presumably this would be open source, so you can verify yourself that it's not going to intercept your bankofamerica.com requests. Also, I think the intent is that any solution to this would include a cryptographic web of trust. However, it's probably still going to be the case that by visiting any .p2p site you are accepting risk--just as visiting many seedy torrents on an unpatched browser is risky now.
- eli 16y ago
  So it'd be impossible to ever log in to an account at any .p2p site because at any point it may suddenly be in the control of an attacker? Seems rather limiting.
  - burgerbrain 16y ago
    Nothing would be preventing you from accessing the site with their regular domain name. This system is meant for when that isn't possible, for the vast majority of websites this is better than nothing. Obviously you should use discretion when using it, but that doesn't mean it isn't a good idea.
  - wladimir 16y ago
    You have to be careful. To be more sure you'd need another means to verify their authenticity (for example a SSL certificate). And preferably use a SSL certificate to authenticate yourself as well instead of a user/password pair. Sure, most websites still live in the 90's where it concerns security, but with P2P it suddenly starts to become much more important to have proper authentication for both sides :)
    - eli 16y ago
      It's not really a decentralized system if it relies on a central signing authority. I'm not sure what problem this solves.
      - wladimir 16y ago
        SSH also checks public keys, without relying on any central signing authority. You could generalize this to SSL easily. You do need to be able to publicize your public key somehow with as little risk of MiTM as possible, but every secure communication method has this problem. Tor solves this by making a hash of the public key part of the URL. Of course, there might be more user-friendly solutions.
  - storborg 16y ago
    Isn't that true of any non-SSL website now?
    - eli 16y ago
      Sure, except the surface area for a man in the middle attack has expanded from, roughly, someone on the same network as you to anyone anywhere on the Internet.
- jrockway 16y ago
  Also, there is really nothing protecting "normal" DNS against spoofing right now. Sure, djbdns and the latest version of BIND are hard to attack (65536 source ports * 65536 transaction ids). But who knows what DNS software your ISP is using? Who knows how your Windows workstation handles forged responses? Incidentally, I think that if DNSSEC ever gets deployed, you'll be able to verify records even after they have been removed from the "real" DNS. That will solve both problems at once... but of course, the Internet always chooses workarounds in favor of clean solutions, so don't count on this happening any time soon. (My house has IPv6. But nothing else does...)
eof 16y ago
Presumably you would only have to trust the network in full. Similar to how bitcoin operates. You might have to trust the 'tracker' to give you a legit network, but once you are in the swarm, it is easy to tell if any of the nodes are lying to you.
zaphar 16y ago
"In this decentralised world, who can be trusted?" Thats a good question. An equally good question is "In this centralized world, who can be trusted?"
- pjvandehaar 16y ago
  In a centralized system, hosts can be held accountable.

by buro9 16y ago

storborg 16y ago

The local application would ensure that only .p2p DNS requests would get handled by this system. Presumably this would be open source, so you can verify yourself that it's not going to intercept your bankofamerica.com requests. Also, I think the intent is that any solution to this would include a cryptographic web of trust. However, it's probably still going to be the case that by visiting any .p2p site you are accepting risk--just as visiting many seedy torrents on an unpatched browser is risky now.

eli 16y ago
So it'd be impossible to ever log in to an account at any .p2p site because at any point it may suddenly be in the control of an attacker? Seems rather limiting.
- burgerbrain 16y ago
  Nothing would be preventing you from accessing the site with their regular domain name. This system is meant for when that isn't possible, for the vast majority of websites this is better than nothing. Obviously you should use discretion when using it, but that doesn't mean it isn't a good idea.
- wladimir 16y ago
  You have to be careful. To be more sure you'd need another means to verify their authenticity (for example a SSL certificate). And preferably use a SSL certificate to authenticate yourself as well instead of a user/password pair. Sure, most websites still live in the 90's where it concerns security, but with P2P it suddenly starts to become much more important to have proper authentication for both sides :)
  - eli 16y ago
    It's not really a decentralized system if it relies on a central signing authority. I'm not sure what problem this solves.
    - wladimir 16y ago
      SSH also checks public keys, without relying on any central signing authority. You could generalize this to SSL easily. You do need to be able to publicize your public key somehow with as little risk of MiTM as possible, but every secure communication method has this problem. Tor solves this by making a hash of the public key part of the URL. Of course, there might be more user-friendly solutions.
- storborg 16y ago
  Isn't that true of any non-SSL website now?
  - eli 16y ago
    Sure, except the surface area for a man in the middle attack has expanded from, roughly, someone on the same network as you to anyone anywhere on the Internet.
jrockway 16y ago
Also, there is really nothing protecting "normal" DNS against spoofing right now. Sure, djbdns and the latest version of BIND are hard to attack (65536 source ports * 65536 transaction ids). But who knows what DNS software your ISP is using? Who knows how your Windows workstation handles forged responses? Incidentally, I think that if DNSSEC ever gets deployed, you'll be able to verify records even after they have been removed from the "real" DNS. That will solve both problems at once... but of course, the Internet always chooses workarounds in favor of clean solutions, so don't count on this happening any time soon. (My house has IPv6. But nothing else does...)

eof 16y ago

Presumably you would only have to trust the network in full. Similar to how bitcoin operates. You might have to trust the 'tracker' to give you a legit network, but once you are in the swarm, it is easy to tell if any of the nodes are lying to you.

zaphar 16y ago

"In this decentralised world, who can be trusted?" Thats a good question. An equally good question is "In this centralized world, who can be trusted?"

pjvandehaar 16y ago
In a centralized system, hosts can be held accountable.