3 ms·

If TLDs are signed (which they have been for a long time), and if the browser checks DNSSEC, you can't typosquat, because you can't spoof the TLD server's signa

If TLDs are signed (which they have been for a long time), and if the browser checks DNSSEC, you can't typosquat, because you can't spoof the TLD server's signature on the typo. That requires no cooperation from anybody but the browser and the TLD. WIth DNSSEC enabled, somebody can still impersonate an unsigned domain, but the whole reason that there are so many unsigned zones to begin with is that nothing checks the signatures, so there's no incentive to sign. By actually doing the checks, browsers, including Firefox, could have created an incentive for widespread DNSSEC signing. So they could have both unilaterally gotten a lot of benefit for their users, and encouraged wider DNSSEC deployment that would have produced further benefit. Add in DANE, and it would also have given a much more satisfying fix for a bunch of CA issues that they've chosen to band-aid with stuff that only half works. You could probably even have gotten to a world with zero-cost TLS certs well before enough pressure built up to make Lets Encrypt come along.

kadoban 5y ago
Interesting, thank you. That does sound more satisfying as a fix (though also sounds harder and possibly riskier. If they're the only ones checking, will some sites be broken only in Firefox?)
tptacek 5y ago
You're saying it's one way, but it's the opposite way. Huge portions of the Internet's user base resolves through servers that will validate DNSSEC if it's available. Still, nobody --- most especially not organizations with serious security teams --- signs their domains. That's not because they don't care about security. It's because DNSSEC makes sites unreliable, and the failure mode for DNSSEC is just about the worst possible mode: your site simply vanishes from the Internet, as if it hadn't existed at all. None of this is hypothetical. It happened, for instance, at the launch of HBO NOW, when a screwed up DNSSEC record made the site vanish for everyone resolving through Comcast, which pointlessly verifies DNSSEC.
- Hizonner 5y ago
  DNS without DNSSEC will also "make your site vanish" if you administer it incompetently. And that's not hypothetical either; it happens all the time. As for the "servers that will validate DNSSEC if it's available", the operators of the servers that "huge portions of the Internet's user base" use are exactly the people who are potential threat actors in most DNS tampering scenarios. That's not useful or effective validation. It makes no sense to put the choice of whether to validate in their hands, and obviously nobody can trust their validation.
SilverRed 5y ago
DNSSEC does not protect privacy which is more important than integrity since TLS already does that. Even worse, making DNSSEC well used might have pushed privacy protocols out of priority as people claim DNS is good enough already.

kadoban 5y ago

Interesting, thank you. That does sound more satisfying as a fix (though also sounds harder and possibly riskier. If they're the only ones checking, will some sites be broken only in Firefox?)

tptacek 5y ago

You're saying it's one way, but it's the opposite way. Huge portions of the Internet's user base resolves through servers that will validate DNSSEC if it's available. Still, nobody --- most especially not organizations with serious security teams --- signs their domains. That's not because they don't care about security. It's because DNSSEC makes sites unreliable, and the failure mode for DNSSEC is just about the worst possible mode: your site simply vanishes from the Internet, as if it hadn't existed at all. None of this is hypothetical. It happened, for instance, at the launch of HBO NOW, when a screwed up DNSSEC record made the site vanish for everyone resolving through Comcast, which pointlessly verifies DNSSEC.

Hizonner 5y ago
DNS without DNSSEC will also "make your site vanish" if you administer it incompetently. And that's not hypothetical either; it happens all the time. As for the "servers that will validate DNSSEC if it's available", the operators of the servers that "huge portions of the Internet's user base" use are exactly the people who are potential threat actors in most DNS tampering scenarios. That's not useful or effective validation. It makes no sense to put the choice of whether to validate in their hands, and obviously nobody can trust their validation.

SilverRed 5y ago

DNSSEC does not protect privacy which is more important than integrity since TLS already does that. Even worse, making DNSSEC well used might have pushed privacy protocols out of priority as people claim DNS is good enough already.