3 ms·
Depends on the registrar used for the domain. Global registrars are not particularly obliged to comply with German law, especially when it is not a case of abus
by AstralStorm 5y ago
Depends on the registrar used for the domain. Global registrars are not particularly obliged to comply with German law, especially when it is not a case of abuse.
However, if the DNS server is located in Germany, they can force that instead.
- toomuchtodo 5y agoI assume they could also announce the address space of the mail server with anycast, depending on the current owner and the IP block size (smaller block, less collateral damage by doing so) of commandeering DNS is overly burdensome or exceeds their reach legally.
- AstralStorm 5y agoThat would run afoul of DKIM and DNSSEC unless they seize the signing key too. Replacing the latter is particularly hard as DNSSEC operates a separate single trust anchor and is not as easy to circumvent silently as say x.509.
- toomuchtodo 5y agoRight, it’s all dependent on how rigorous sending MXs are validating the receiving MX cryptographically and if the gov can obtain keying material (or rekey). The MITM part is fairly trivial for a competent nation state.
- AstralStorm 5y agoEven obtaining valid DNSSEC and x.509 is easy, as DE government has its own trusted key subroot. It is a strong case for using key pinning on all levels, from routing protocols through DNS all the way to email signatures.
- deleted 5y ago[deleted]
- gruez 5y agoIt's possible, but it would have to be a pretty important target because if it gets discovered, the root would get revoked and can't be used for such purposes again.
- AstralStorm 5y agoThat would be a political landmine to revoke a lawfult interception root. You could do that, but there's nothing stopping German government from issuing another. Did you see anyone ban Turkey or China roots?