3 ms·

u/tptacek has made this argument a lot before. It's a fallacious argument because we can all see that when government X says JUMP, the companies they order eit

u/tptacek has made this argument a lot before. It's a fallacious argument because we can all see that when government X says JUMP, the companies they order either JUMP or EXIT, and when those companies lack an EXIT option, they always JUMP. The reason for this is that no cryptography can beat the rubber hose, and no cryptographic protocol can either. No PKI, whether loose like WebPKI, rooted like DNSSEC (or as PKI was intended to be), or with multiple roots sharing subtrees (e.g., as DNSSEC would be if, say, Russia decided to require Russians to use Russian roots that happen to sign com and such as they are), can possibly get around the fact that the certification authorities that make it up are subject to the jurisdiction of some government. It's why we all don't want the CN NIC in our trust anchor sets, for example, or only want it if name-constrained. There is not getting around this. So u/tptacek doesn't trust the DNS root, but so what, why should he trust any WebPKI CA at all, or all of them? Any one of them can be compromised by the end of a gun, and then all who have it in the trust anchors will be compromised too. Sure, there's CT (certificate transparency), but there is nothing so PKIX-specific to CT that it couldn't be applied to DNSSEC, and anyways, I'm unconvinced that it's enough. There comes a point where certain governments don't even care if they leave evidence of their nasty behavior for all to see -- when push comes to shove, any government with jurisdiction over you can end your happiness and even your life. Oh? The world can see? But what can the world do for, e.g., HK? A big fat not much.

cryptonector 6y ago
Also, DNSSEC does have one thing PKIX doesn't and can't have: QName minimization. That's where instead of sending the full domainname for any query to the root and all intermediate zones, you only ever ask each zone for its domainname + the next label of the domainname you really want. Imagine you're a subject of interest to the U.S. government, and they're willing to risk public knowledge of their access to root keys, say, in order to spy on you. And say you're vising some site like antifa.github.io. So you ask . for io, and io for github.io, and github.io for antifa.github.io, and only at the last hop can the LEO/TLA system spying on you decide that yes, they want to MITM you there. So either they have to MITM you everywhere, or they have to MITM you only at zones they can control, and this is a decision they have to make online. That's a big deal. If they decide to MITM you when you asked for io, but you expected this so you had io's public keys, and . tells you different keys, then you've detected the espionage attempt. WebPKI can't do this. By the time some server (or MITM) sees your SNI they've also seen your DNS queries. Even if you're using DoH/DoE (which also gets you similar protection in a DNSSEC world), if the SNI is not encrypted, still, they know what to do. And so on. Let's say you're using DoH/DoE with a resolver the LEO/TLA can't control, then they could simply kick your door in and take your stuff and beat you up. Crypto can make things harder for them, but not infinitely harder. The CCP won't give a damn about leaving evidence in CT logs, for example -- maybe today they do, but when push comes to shove, forget about it.

cryptonector 6y ago

Also, DNSSEC does have one thing PKIX doesn't and can't have: QName minimization. That's where instead of sending the full domainname for any query to the root and all intermediate zones, you only ever ask each zone for its domainname + the next label of the domainname you really want. Imagine you're a subject of interest to the U.S. government, and they're willing to risk public knowledge of their access to root keys, say, in order to spy on you. And say you're vising some site like antifa.github.io. So you ask . for io, and io for github.io, and github.io for antifa.github.io, and only at the last hop can the LEO/TLA system spying on you decide that yes, they want to MITM you there. So either they have to MITM you everywhere, or they have to MITM you only at zones they can control, and this is a decision they have to make online. That's a big deal. If they decide to MITM you when you asked for io, but you expected this so you had io's public keys, and . tells you different keys, then you've detected the espionage attempt. WebPKI can't do this. By the time some server (or MITM) sees your SNI they've also seen your DNS queries. Even if you're using DoH/DoE (which also gets you similar protection in a DNSSEC world), if the SNI is not encrypted, still, they know what to do. And so on. Let's say you're using DoH/DoE with a resolver the LEO/TLA can't control, then they could simply kick your door in and take your stuff and beat you up. Crypto can make things harder for them, but not infinitely harder. The CCP won't give a damn about leaving evidence in CT logs, for example -- maybe today they do, but when push comes to shove, forget about it.