6 ms·

Cloudflare approach is pushy, but many companies need a push. No RPKI and also no DNSSEC support. When will Andrews & Arnold do something about it?

tptacek 7y ago
Hopefully never, on the DNSSEC side. Of course, very few other ISPs (or tech and telecom companies of any sort) use DNSSEC either.
- mlyle 7y ago
  Yay, let's leave DNS pwned because we have some disputes and the alternative isn't perfectly technically pretty. /s
  - tptacek 7y ago
    This is snark but it's snarking up an interesting architectural issue, that being: "where do we draw the line?" Say we protect DNS (we could, with a better protocol design). But other redirection protocols aren't protected. Do we similarly authenticate OSPF? IP options? ARP? The easy response to your snark is "no, people are just going to use DoH".
    - mlyle 7y ago
      We've had decent authentication in OSPF for ... decades. Most of the egregious problems with IP options have been worked around well, again for decades. ARP is problematic, but only within a segment. Your attacker has to be close. For IPv6, we have SEND, but it is not without problems. > The easy response to your snark is "no, people are just going to use DoH". DoH doesn't prevent someone from poisoning well-trafficked DoH resolvers to redirect individual domains. DNSSEC does. I run it on my zones, and it's not so bad... About 40% of resolver traffic to my domains is verifying, too, so we're getting there...
      - tptacek 7y ago
        DNSSEC does nothing to protect queries on the wire on their way to resolving servers (it collapses down to a single bit in the header), unlike DoH, which does protect those queries. Those queries are the most likely attack vector against DNS. Meanwhile, however many resolvers are validating queries to your own domains, virtually none of the most important (ie, well-trafficked) domains on the Internet are signed, or likely ever to be signed. At the same time, browsers have removed DNSSEC code. DNSSEC is moribund. DoH has already protected more people in the brief time that it has existed.
        mlyle 7y ago
        > DNSSEC does nothing to protect queries on the wire on their way to resolving servers (it collapses down to a single bit in the header), unlike DoH, which does protect those queries. Yes, and DoH does nothing to protect queries between resolving servers and authoritative servers, unlike DNSSEC, which does protect those queries. Together, you end up with end to end protection.
        tptacek 7y ago
        That's true: DOH doesn't protect outbound communication from caches, until authority servers expose DOT or DOH endpoints for them to talk to --- which should happen, and is likely to happen long before DNSSEC. But DNS attacks almost always target endpoints (DNS attacks are rare, and heavily mitigated by the rest of the networking stack, which is why practically nobody deployed DNSSEC).
        mlyle 7y ago
        DOH resolvers don't recurse via HTTPS, and there are few/no authoritative DOH authorities. DOH just exposes much larger, more dangerous targets for poisoning at this point. Something like 30% of domains in .COM have DNSSEC, in part because of things like Cloudflare making it so dang easy. Yes, the top domains / services tend not to, and this is unfortunate. But we're well on our way. And the possibility for poisoning worsens other attacks (it's still trivial in many cases to steal email with DNS cache poisoning... 25 years after I first played with the idea). There's no reason not to deploy DNSSEC today. The DOH resolvers you're enamored with are almost all validating, so it's a way to get end to end validation right now.

tptacek 7y ago

Hopefully never, on the DNSSEC side. Of course, very few other ISPs (or tech and telecom companies of any sort) use DNSSEC either.

mlyle 7y ago
Yay, let's leave DNS pwned because we have some disputes and the alternative isn't perfectly technically pretty. /s
- tptacek 7y ago
  This is snark but it's snarking up an interesting architectural issue, that being: "where do we draw the line?" Say we protect DNS (we could, with a better protocol design). But other redirection protocols aren't protected. Do we similarly authenticate OSPF? IP options? ARP? The easy response to your snark is "no, people are just going to use DoH".
  - mlyle 7y ago
    We've had decent authentication in OSPF for ... decades. Most of the egregious problems with IP options have been worked around well, again for decades. ARP is problematic, but only within a segment. Your attacker has to be close. For IPv6, we have SEND, but it is not without problems. > The easy response to your snark is "no, people are just going to use DoH". DoH doesn't prevent someone from poisoning well-trafficked DoH resolvers to redirect individual domains. DNSSEC does. I run it on my zones, and it's not so bad... About 40% of resolver traffic to my domains is verifying, too, so we're getting there...
    - tptacek 7y ago
      DNSSEC does nothing to protect queries on the wire on their way to resolving servers (it collapses down to a single bit in the header), unlike DoH, which does protect those queries. Those queries are the most likely attack vector against DNS. Meanwhile, however many resolvers are validating queries to your own domains, virtually none of the most important (ie, well-trafficked) domains on the Internet are signed, or likely ever to be signed. At the same time, browsers have removed DNSSEC code. DNSSEC is moribund. DoH has already protected more people in the brief time that it has existed.
      - mlyle 7y ago
        > DNSSEC does nothing to protect queries on the wire on their way to resolving servers (it collapses down to a single bit in the header), unlike DoH, which does protect those queries. Yes, and DoH does nothing to protect queries between resolving servers and authoritative servers, unlike DNSSEC, which does protect those queries. Together, you end up with end to end protection.
        tptacek 7y ago
        That's true: DOH doesn't protect outbound communication from caches, until authority servers expose DOT or DOH endpoints for them to talk to --- which should happen, and is likely to happen long before DNSSEC. But DNS attacks almost always target endpoints (DNS attacks are rare, and heavily mitigated by the rest of the networking stack, which is why practically nobody deployed DNSSEC).
        mlyle 7y ago
        DOH resolvers don't recurse via HTTPS, and there are few/no authoritative DOH authorities. DOH just exposes much larger, more dangerous targets for poisoning at this point. Something like 30% of domains in .COM have DNSSEC, in part because of things like Cloudflare making it so dang easy. Yes, the top domains / services tend not to, and this is unfortunate. But we're well on our way. And the possibility for poisoning worsens other attacks (it's still trivial in many cases to steal email with DNS cache poisoning... 25 years after I first played with the idea). There's no reason not to deploy DNSSEC today. The DOH resolvers you're enamored with are almost all validating, so it's a way to get end to end validation right now.