3 ms·
The argument seems to be that if your attacker is stupid enough to only change your NS records and doesn't know about DS records, then DNSSEC will provide some
by phicoh 8y ago
The argument seems to be that if your attacker is stupid enough to only change your NS records and doesn't know about DS records, then DNSSEC will provide some protection.
It is not clear with ICANN mentions this, because somebody hacking your registry account (or somebody hacking your registry or the registrar) are attacks DNSSEC cannot protect against.
- quicksilver03 8y agoA threat model where the attacker is assumed to be stupid is a very weak threat model. Better to assume that the attacker is at least as knowledgeable as you are.