3 ms·

The definition of mississuance is based on DNS data so DNS does matter for CAs. Conceptually DNSSEC would help except no one uses it.

by wbl 7y ago

tptacek 7y ago
I'm glad you acknowledge that nobody uses DNSSEC. It is not, however, the case that DNS is required to verify domain ownership, or even the only automated way. It's just the most common way. Nor is the the case that DNSSEC is the only way to protect DNS lookups; it's not even the most common way.
alwillis 7y ago
Conceptually DNSSEC would help except no one uses it. Some stats from this April 2019 presentation [1]: * 91% of TLDs (.com, .org, .edu, etc.) are signed, including root, which was signed in 2010. * about 20% of internet users are using validating resolvers, mostly thanks to Google and Cloudflare. I'd add Comcast too. * Over 50% of the zones in .nl, .se and .no are DNSSEC-signed [1]: https://www.isc.org/docs/dnssec-eco-de-20190410.pdf https://www.isc.org/docs/dnssec-eco-de-20190410.pdf
- tptacek 7y ago
  TLDs being signed doesn't mean anything, except that for the 9% of TLDs that aren't signed it's literally impossible to sign zones under them. TLD signatures are de facto required. What's actually damning is that DNS customers, including the ones with the savviest security teams, aren't opting in, and haven't for many, many years. They all have a choice whether to sign or not, and they choose not to. Unlike TLD signatures, that actually is a strong signal. Signatures of European zones aren't interesting because they're done automatically by registrars. That's theater, not security.
- alwillis 7y ago
  Here’s more actual data on DNSSEC. Spoiler: DNSSEC use is going up; DANE usage is way up: https://stats.dnssec-tools.org/# https://stats.dnssec-tools.org/#
  - tptacek 7y ago
    And, as you can see from the breakdown at the bottom of this list, the majority of that growth is in places like .NL, where DNSSEC is almost compulsory. It's not hard to check this for yourself. Just start with a list of the top domains on the Internet; I used the Moz Top 500, but Alexa will do fine. Create a flat text file with one domain per line, then do: for N in `cat file` do; host -t ds $N; done You'll see what I see: First, dozens of .GOV sites have DNSSEC delegations because, until a couple years ago, DNSSEC was mandatory in the USG; that mandate has since been rescinded. Second, excluding those .GOV sites, the entire list of signed domains in the Moz Top 500 is as follows: 000webhost.com addtoany.com berkeley.edu bund.de cloudflare.com cmu.edu europa.eu example.com foxnews.com icann.org ietf.org mediafire.com mozilla.org one.com paypal.com pixabay.com stanford.edu themeforest.net time.com welt.de xfinity.com I note with what I hope is plainly evident glee that while PAYPAL.COM is signed, none of Paypal's subsidiaries, like Braintree or Venmo, are.

The definition of mississuance is based on DNS data so DNS does matter for CAs. Conceptually DNSSEC would help except no one uses it.

by wbl 7y ago

The definition of mississuance is based on DNS data so DNS does matter for CAs. Conceptually DNSSEC would help except no one uses it.

tptacek 7y ago

I'm glad you acknowledge that nobody uses DNSSEC. It is not, however, the case that DNS is required to verify domain ownership, or even the only automated way. It's just the most common way. Nor is the the case that DNSSEC is the only way to protect DNS lookups; it's not even the most common way.

alwillis 7y ago

Conceptually DNSSEC would help except no one uses it. Some stats from this April 2019 presentation [1]: * 91% of TLDs (.com, .org, .edu, etc.) are signed, including root, which was signed in 2010. * about 20% of internet users are using validating resolvers, mostly thanks to Google and Cloudflare. I'd add Comcast too. * Over 50% of the zones in .nl, .se and .no are DNSSEC-signed [1]: https://www.isc.org/docs/dnssec-eco-de-20190410.pdf https://www.isc.org/docs/dnssec-eco-de-20190410.pdf

tptacek 7y ago
TLDs being signed doesn't mean anything, except that for the 9% of TLDs that aren't signed it's literally impossible to sign zones under them. TLD signatures are de facto required. What's actually damning is that DNS customers, including the ones with the savviest security teams, aren't opting in, and haven't for many, many years. They all have a choice whether to sign or not, and they choose not to. Unlike TLD signatures, that actually is a strong signal. Signatures of European zones aren't interesting because they're done automatically by registrars. That's theater, not security.
alwillis 7y ago
Here’s more actual data on DNSSEC. Spoiler: DNSSEC use is going up; DANE usage is way up: https://stats.dnssec-tools.org/# https://stats.dnssec-tools.org/#
- tptacek 7y ago
  And, as you can see from the breakdown at the bottom of this list, the majority of that growth is in places like .NL, where DNSSEC is almost compulsory. It's not hard to check this for yourself. Just start with a list of the top domains on the Internet; I used the Moz Top 500, but Alexa will do fine. Create a flat text file with one domain per line, then do: for N in `cat file` do; host -t ds $N; done You'll see what I see: First, dozens of .GOV sites have DNSSEC delegations because, until a couple years ago, DNSSEC was mandatory in the USG; that mandate has since been rescinded. Second, excluding those .GOV sites, the entire list of signed domains in the Moz Top 500 is as follows: 000webhost.com addtoany.com berkeley.edu bund.de cloudflare.com cmu.edu europa.eu example.com foxnews.com icann.org ietf.org mediafire.com mozilla.org one.com paypal.com pixabay.com stanford.edu themeforest.net time.com welt.de xfinity.com I note with what I hope is plainly evident glee that while PAYPAL.COM is signed, none of Paypal's subsidiaries, like Braintree or Venmo, are.