5 ms·

Use DNSSEC.

by gsich 6y ago

Use DNSSEC.

tptacek 6y ago
DNSSEC doesn't do that at all. DNSSEC does no transaction encryption. It allows full recursive resolvers --- the kind virtually nobody runs on their own machines --- to validate signatures on the tiny minority of domains (virtually none of them among the most popular on the Internet) that have opted in to DNSSEC over the last 10 years. Note that even in the unusual corner case where you're looking up a name that's actually signed with a DNS recursor that actually verifies DNSSEC signatures, the network between you can still snoop on all your DNS requests, because DNSSEC is bad. If you're worried that your network upstream is intercepting your DNS requests (and if you're in the US on a mainstream ISP, you should be), this is the problem DoH is designed to solve, and it does so quite effectively.
- gsich 6y ago
  DoH does not solve the problem that the resolver can just feed you wrong data. So if you want integrity for your DNS records you need DNSSEC. DoH/DoT does not solve that.
  - iso1631 6y ago
    DOH to your trusted resolver which you run yourself (which uses DNSSec upstream) Shame that I have 20 applications on several different users on two dozen different machines to configure
  - tptacek 6y ago
    DoH deliberately doesn't touch that problem. In 25 years of work, DNSSEC hasn't put a dent in it --- look at the stats on which zones are signed (and note that most of those signatures are security theater, done automatically by registrars). The fact is that there's nothing you can do to authenticate DNS records, and turning some silly "DNSSEC" feature on in your own stack won't do anything but make you feel better, because DNSSEC simply doesn't have meaningful adoption. However, enabling DoH does in fact immediately protect you from attacks that really do happen, like ISPs monetizing your DNS.
    - gsich 6y ago
      >DoH deliberately doesn't touch that problem. Exactly. That's what I said. The problem is that DoH is not the solution, as you just change trust from resolver A to resolver B. With no indication that B is better than A. If you fear that your ISP is selling your data you need to change your ISP. The ISP always know what sites you are accessing, regardless of DNS. DNS might be easier than SNI or IP lookups but the danger is still the same. Right now it might actually help but once encrypted DNS gets enough traction those methods will also adapt. (Assuming that ISPs still do that practice)
      - tptacek 6y ago
        It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways. While I have strong normative beliefs here, I'm mostly just posting descriptively. DNSSEC isn't happening. Enabling DNSSEC in your local configuration won't meaningfully protect you, because you depend on the security teams of large companies to also participate in the system, and DNSSEC has been more or less rejected by the market. Meanwhile: there are specific problems that DoH does protect against, it's easy to roll out, and doesn't depend on the Stripe security team changing their mind about DNSSEC --- so DoH is on a path to become universal, even as DNSSEC whithers. (I invite the curious to test my reporting out with the `host -t ds foo.com` command, for arbitrary values of "foo"). I know I sound like a sore winner about this, and I guess I sort of am, but it is a little alarming that there are still currents of sysadmin wisdom telling people to go out of their way to opt into DNSSEC, in the belief that it will somehow protect them from any kind of real attack. In reality: corrupted DNS records overwhelmingly come from phished registrar accounts, not the elaborate, geographically-specific DNS cache corruption attacks DNSSEC was envisaged to deal with. I think it's worth being plain with people about this stuff.
        gsich 6y ago
        >It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways. Of course. If you know that your ISP is doing that, you change to one that is not doing it. It's not ubiquitous. Besides that, what makes you think that your DoH provider (if not your ISP) is also not selling that data? You think that DoH/DoT is somewhat a replacement for DNSSEC but it's not. Both are independent. Doesn't matter how much domains have it.

Use DNSSEC.

by gsich 6y ago

Use DNSSEC.

DNSSEC doesn't do that at all. DNSSEC does no transaction encryption. It allows full recursive resolvers --- the kind virtually nobody runs on their own machines --- to validate signatures on the tiny minority of domains (virtually none of them among the most popular on the Internet) that have opted in to DNSSEC over the last 10 years. Note that even in the unusual corner case where you're looking up a name that's actually signed with a DNS recursor that actually verifies DNSSEC signatures, the network between you can still snoop on all your DNS requests, because DNSSEC is bad. If you're worried that your network upstream is intercepting your DNS requests (and if you're in the US on a mainstream ISP, you should be), this is the problem DoH is designed to solve, and it does so quite effectively.

gsich 6y ago
DoH does not solve the problem that the resolver can just feed you wrong data. So if you want integrity for your DNS records you need DNSSEC. DoH/DoT does not solve that.
- iso1631 6y ago
  DOH to your trusted resolver which you run yourself (which uses DNSSec upstream) Shame that I have 20 applications on several different users on two dozen different machines to configure
- tptacek 6y ago
  DoH deliberately doesn't touch that problem. In 25 years of work, DNSSEC hasn't put a dent in it --- look at the stats on which zones are signed (and note that most of those signatures are security theater, done automatically by registrars). The fact is that there's nothing you can do to authenticate DNS records, and turning some silly "DNSSEC" feature on in your own stack won't do anything but make you feel better, because DNSSEC simply doesn't have meaningful adoption. However, enabling DoH does in fact immediately protect you from attacks that really do happen, like ISPs monetizing your DNS.
  - gsich 6y ago
    >DoH deliberately doesn't touch that problem. Exactly. That's what I said. The problem is that DoH is not the solution, as you just change trust from resolver A to resolver B. With no indication that B is better than A. If you fear that your ISP is selling your data you need to change your ISP. The ISP always know what sites you are accessing, regardless of DNS. DNS might be easier than SNI or IP lookups but the danger is still the same. Right now it might actually help but once encrypted DNS gets enough traction those methods will also adapt. (Assuming that ISPs still do that practice)
    - tptacek 6y ago
      It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways. While I have strong normative beliefs here, I'm mostly just posting descriptively. DNSSEC isn't happening. Enabling DNSSEC in your local configuration won't meaningfully protect you, because you depend on the security teams of large companies to also participate in the system, and DNSSEC has been more or less rejected by the market. Meanwhile: there are specific problems that DoH does protect against, it's easy to roll out, and doesn't depend on the Stripe security team changing their mind about DNSSEC --- so DoH is on a path to become universal, even as DNSSEC whithers. (I invite the curious to test my reporting out with the `host -t ds foo.com` command, for arbitrary values of "foo"). I know I sound like a sore winner about this, and I guess I sort of am, but it is a little alarming that there are still currents of sysadmin wisdom telling people to go out of their way to opt into DNSSEC, in the belief that it will somehow protect them from any kind of real attack. In reality: corrupted DNS records overwhelmingly come from phished registrar accounts, not the elaborate, geographically-specific DNS cache corruption attacks DNSSEC was envisaged to deal with. I think it's worth being plain with people about this stuff.
      - gsich 6y ago
        >It's funny that you've managed simultaneously to argue that DNS monetization (which is ubiquitous) is both a reason to immediately change ISPs, and also not a big deal because ISPs can snoop on you anyways. Of course. If you know that your ISP is doing that, you change to one that is not doing it. It's not ubiquitous. Besides that, what makes you think that your DoH provider (if not your ISP) is also not selling that data? You think that DoH/DoT is somewhat a replacement for DNSSEC but it's not. Both are independent. Doesn't matter how much domains have it.