3 ms·
I remember during 2009 IETF meeting talking about using end-to-end, and the response I got back was that DNS resolving must be a simple caching server at the IS
by belorn 6y ago
I remember during 2009 IETF meeting talking about using end-to-end, and the response I got back was that DNS resolving must be a simple caching server at the ISP end because companies has shown that for every millisecond slower a website loaded there was a noticeable loss in sales, and thus anything that impact performance would not be acceptable.
Under that mentality you could not do much with the last-mile, and you can definitely not do any serious security that protect confidentiality between client and server. You could do something DNSSEC because it did not cause a 10ms lookup to go to 11ms, and thus no one was screaming bloody murder over it.
- tptacek 6y agoWhich is "something must be done; this is something" logic, right? It's pretty plain to see that the operator community did not in fact want DNSSEC, despite its favorable latency characteristics.
- belorn 6y agoThe original intent behind dnssec is before my time working in the dns industry, and when it come the last couple decades the larger push seems to be focused on making people feel more secure in using dns for identification and authentication purposes. How well it does the job depend a lot on the threat model, and how large the actually risks are for that model. How likely is it that an attacker can take over an domain on say cloudflare/microsoft using dns authentication, or someone managing to spoofing an email by changing the dmarc signature? On the average case I suspect the risk is very small, but then I don't think that specific attack surface has been well tested enough to demonstrate how good the idea is to put keys and proof of identity in dns without any additional system to validate the records.
- tptacek 6y agoI worked at Network Associates not long after they bought TIS, which had the original DARPA contract for DNSSEC, and had been working on DNS security for at least 2 years prior to that, and the push then was (unfortunately) the same as it is now: to authenticate the DNS, to create a resilient global PKI that can be used to increase the importance of the DNS in other applications. Privacy has literally never been in its remit; that's why they spun up a separate WG (DPRIVE) to work on it.
- deleted 6y ago[deleted]