3 ms·
Does DNSSEC upgrade http:// http:// to https:// https:// ? If not, then it doesn't solve the specific problem Troy and I were talking about (namely MITMs snoopi
by Thorrez 7y ago
Does DNSSEC upgrade http:// http:// to https:// https:// ? If not, then it doesn't solve the specific problem Troy and I were talking about (namely MITMs snooping on http:// http:// traffic).
What's the primary attack that DANE attempts to protect against? CAs issuing certs to entities they shouldn't? Troy doesn't seem to be worried about those attacks.
- xorcist 7y agoThere are several kinds of MITM. DNSSEC makes rebinding, poisoning and DNS interception for capturing and modifying traffic neutered. Being a protocol it is however ineffective against other attacks such as unauthorized domain transfers. What artursapek describes is probably that, while you are of course correct that no improved encryption could possibly improve on the fact that web browsers still default to unencrypted communications. So the problems are mostly complementary, but rebinding and poisoning offers an attacker more ways of intercepting cleartext traffic unless mitigated.