3 ms·

I don't understand what's the point of DNSSEC. Literally the only attack scenario that DNSSEC protects from is when someone is MITMing your ISP, which, I believ

I don't understand what's the point of DNSSEC. Literally the only attack scenario that DNSSEC protects from is when someone is MITMing your ISP, which, I believe, is something that practically never happens. It doesn't do anything about the most common attack scenarios, such as MITM between the client and the last mile DNS server or hackers stealing your domain registrar credentials. To be honest, it seems to me that the real purpose of this protocol is to make people/enterprises feel safer without actually doing anything useful.

phicoh 8y ago
DNS hijacks at routing level are not common. But they do happen: https://www.theregister.co.uk/2018/04/24/myetherwallet_dns_hijack/ https://www.theregister.co.uk/2018/04/24/myetherwallet_dns_h... DNSSEC fully supports DNSSEC validation on the host. So the main reason you have to trust your ISP's recursive resolvers is that software vendors, in particular browser vendors, don't want to do DNSSEC validation. Of course you can run your own local validating resolver.
- tptacek 8y ago
  An attacker that controls routing can bypass the DNS entirely, so it's hard to see how protecting the DNS from that attacker serves any meaningful purpose.
wtallis 8y ago
> Literally the only attack scenario that DNSSEC protects from is when someone is MITMing your ISP, which, I believe, is something that practically never happens. It also helps when your ISP is MITMing your attempts to get accurate DNS information. That happens all the time, though most of it is just sending you to advertisements when you're supposed to get NXDOMAIN.
- viraptor 8y ago
  DNS over HTTPS also solves this one.
- xeeeeeeeeeeenu 8y ago
  No, it does not protect from that. Stub resolvers (i.e. DNS clients) fully trust recursive resolvers by design and don't validate DNSSEC signatures. In theory the client can validate them but, for various reasons, pretty much none of the implementations do that.

phicoh 8y ago

DNS hijacks at routing level are not common. But they do happen: https://www.theregister.co.uk/2018/04/24/myetherwallet_dns_hijack/ https://www.theregister.co.uk/2018/04/24/myetherwallet_dns_h... DNSSEC fully supports DNSSEC validation on the host. So the main reason you have to trust your ISP's recursive resolvers is that software vendors, in particular browser vendors, don't want to do DNSSEC validation. Of course you can run your own local validating resolver.

tptacek 8y ago
An attacker that controls routing can bypass the DNS entirely, so it's hard to see how protecting the DNS from that attacker serves any meaningful purpose.

wtallis 8y ago

> Literally the only attack scenario that DNSSEC protects from is when someone is MITMing your ISP, which, I believe, is something that practically never happens. It also helps when your ISP is MITMing your attempts to get accurate DNS information. That happens all the time, though most of it is just sending you to advertisements when you're supposed to get NXDOMAIN.

viraptor 8y ago
DNS over HTTPS also solves this one.
xeeeeeeeeeeenu 8y ago
No, it does not protect from that. Stub resolvers (i.e. DNS clients) fully trust recursive resolvers by design and don't validate DNSSEC signatures. In theory the client can validate them but, for various reasons, pretty much none of the implementations do that.