3 ms·
> auto-signed by registrars, which is security theater Do you consider Let's Encrypt security theater? > And after 25 years of pointless effort, no meaningfu
by wahern 7y ago
> auto-signed by registrars, which is security theater
Do you consider Let's Encrypt security theater?
> And after 25 years of pointless effort, no meaningful adoption has occurred; rather, it has been un-adopted from the few places that tried.
For a long time the zone enumeration "problem" plagued DNSSEC. Everybody thought it was a fatal flaw, and it even led to a redesign that added complexity in an attempt to mitigate it. This made DNSSEC seem unnecessarily costly, a potential insecurity, and substantially hurt deployment.
Fast forward two decades and best practice is to put all your corporate resources on the public network, hosted by third parties. The refrain from those advocating for Google and Cloudflare DoH proxies is that organizations should be moving away from hidden domains. Well, if you don't have hidden internal networks and don't care about leaking your subdomains, then DNSSEC is simple and easy to deploy when self-hosting DNS, and a trivial upgrade to DNS hosting providers.
I get that you're a long-term opponent of DNSSEC. Well, I'm a weak opponent of QUIC, especially QUIC outside the kernel. That doesn't mean I don't appreciate and recognize the benefits, or actively try to oppose it. I try not to be inconsistent.
If you think Let's Encrypt is great, and you advocate for centralized DoH, then the major objections to DNSSEC cannot be sustained. That's different than affirmatively advocating for DNSSEC, but I just don't get the fierce opposition. To say that DNSSEC is, on balance, worse for the Internet (e.g. security theater) seems preposterous to me.
- tptacek 7y agoWould you trust LetsEncrypt more if the US DOJ ran it? I really don't know how I can respond to this comment any better than I already did, years ago: https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/ As you'll see, I have multiple reasons to believe DNSSEC is a powerful net negative for the Internet. The simplest one to communicate is that unlike LetsEncrypt, whose nuts-and-bolts security DNSSEC does not improve on, DNSSEC also escrows out authority to world governments. But there are other arguments that are actually more meaningful to me, such as the clunky, 1990s design of its cryptography and the near-certainty that its installed base will be RSA-dependent for the protocol's entire lifespan, be it 1 year or 20. That piece goes into a lot more detail that I won't belabor here. My point on this thread though is simple and factual and descriptive: an ordinary user of the Internet --- in fact, even an ordinary software developer on HN --- can expect to interact with the Internet at length without ever once coming into contact with a website on a DNSSEC-signed zone. You see DNSSEC brought up on these threads as if it was an important operational security concern for people setting up Pi-Holes and whatnot, and you know as well as I do that's simply false. You probably assume at first blush that I'm snarking when I say the DNSSEC root keys could be Pastebinned to no real ill-effect, but if you think about it for a few minutes I think you'll find that I'm not snarking at all. You want DNSSEC to work, and you're right, I don't, but neither of us can kid each other about the fact that it's not working now.