3 ms·

DNSSEC isn’t coming anytime soon. AWS and azure don’t even support it yet. More likely this will be resolved by DoH than DNSSEC. Isn’t chrome suppose to adopt

by adrr 6y ago

DNSSEC isn’t coming anytime soon. AWS and azure don’t even support it yet. More likely this will be resolved by DoH than DNSSEC. Isn’t chrome suppose to adopt it this fall and Firefox already has it with the default being cloudflare as the resolver.

tptacek 6y ago
"Yet". It's been almost 25 years.
jeroenhd 6y ago
DNSSEC is coming though. Cloudflare supports it and half the internet runs on Cloudflare. Amazon and Azure are still lagging behind, but those aren't going to ignore DNSSEC forever. DoH solves nothing in this context unless we centralise DNS resolution to Google or Cloudflare. The Windows method submits the DNS requests to the same server as your regular DNS server by default, so the protocol doesn't give you any advantage there. Chrome does the same thing; if it detects that your name server does DoH, it'll switch to that, but it won't switch DNS servers. Perhaps this does solve the problem for the few people with custom DNS servers getting their queries intercepted, but the vast majority of people (everyone not using Firefox inside the US) won't notice any difference. DNSSEC will solve this problem by making the certification chain break for domains that haven't been signed by their TLD, but only if we start enforcing it (like we are enforcing HTTPS for certain features already). DNS over HTTPS will just encrypt the bad NXDOMAIN DNS query when it comes from the same malicious server, only protecting against traffic interception when using different DNS servers; the two protocols serve different purposes.
- tptacek 6y ago
  Cloudflare sells DNSSEC services. They've supported DNSSEC for years, and adoption of DNSSEC in the US --- outside of people who get it by default with Cloudflare --- hasn't budged. DoH breaks ISP DNS interception immediately, and for all zones, not just the rare DNSSEC-signed ones, by moving DNS resolution off-net to a more trusted provider. The irony is, breaking NXDOMAIN interception is in fact a core use case of DNSSEC, and the protocol simply won't work for it, because the ocean needs to boil before every vector of the attack is closed. DoH went from the whiteboard to deployment in a tiny fraction of the time, and actually closes this hole decisively.
Ericson2314 6y ago
I am not against DoH, but it only helps with the privacy of the request/response wrt snoopers. It doesn't help with the authenticity of the response, which is the problem being addressed by this mechanism. (That the firefox solution works is due to the root servers themselves being deemed trustworthy, and the ISP ones being tentatively not, but the DNSSEC solution is strictly better as now nothing needs to be trusted.)

by adrr 6y ago

tptacek 6y ago

"Yet". It's been almost 25 years.

jeroenhd 6y ago

DNSSEC is coming though. Cloudflare supports it and half the internet runs on Cloudflare. Amazon and Azure are still lagging behind, but those aren't going to ignore DNSSEC forever. DoH solves nothing in this context unless we centralise DNS resolution to Google or Cloudflare. The Windows method submits the DNS requests to the same server as your regular DNS server by default, so the protocol doesn't give you any advantage there. Chrome does the same thing; if it detects that your name server does DoH, it'll switch to that, but it won't switch DNS servers. Perhaps this does solve the problem for the few people with custom DNS servers getting their queries intercepted, but the vast majority of people (everyone not using Firefox inside the US) won't notice any difference. DNSSEC will solve this problem by making the certification chain break for domains that haven't been signed by their TLD, but only if we start enforcing it (like we are enforcing HTTPS for certain features already). DNS over HTTPS will just encrypt the bad NXDOMAIN DNS query when it comes from the same malicious server, only protecting against traffic interception when using different DNS servers; the two protocols serve different purposes.

tptacek 6y ago
Cloudflare sells DNSSEC services. They've supported DNSSEC for years, and adoption of DNSSEC in the US --- outside of people who get it by default with Cloudflare --- hasn't budged. DoH breaks ISP DNS interception immediately, and for all zones, not just the rare DNSSEC-signed ones, by moving DNS resolution off-net to a more trusted provider. The irony is, breaking NXDOMAIN interception is in fact a core use case of DNSSEC, and the protocol simply won't work for it, because the ocean needs to boil before every vector of the attack is closed. DoH went from the whiteboard to deployment in a tiny fraction of the time, and actually closes this hole decisively.

Ericson2314 6y ago

I am not against DoH, but it only helps with the privacy of the request/response wrt snoopers. It doesn't help with the authenticity of the response, which is the problem being addressed by this mechanism. (That the firefox solution works is due to the root servers themselves being deemed trustworthy, and the ISP ones being tentatively not, but the DNSSEC solution is strictly better as now nothing needs to be trusted.)