4 ms·
That would be potentially dangerous. This is old, but according to their site[1], IE used to use it for "Zone determination" and "ActiveX opt-in list security
by _jal 5y ago
That would be potentially dangerous.
This is old, but according to their site[1], IE used to use it for "Zone determination" and "ActiveX opt-in list security restriction".
If DNS were referenced for these purposes, that's how you get 0wned by accepting DHCP at your local coffee shop.
[1] https://publicsuffix.org/learn/ https://publicsuffix.org/learn/
- quotemstr 5y ago> that's how you get 0wned by accepting DHCP at your local coffee shop. Code authentication is what certificates are for. What is the precise attack you're describing? "Potentially dangerous" doesn't cut it. In any case, DNSSEC addresses any possible coffee shop attack.
- tptacek 5y agoNo, DNSSEC doesn't address any coffee shop attacks. DNSSEC is a server-to-server protocol (or, I guess more fairly, a recursor-to-recursor) protocol. Unless you're running something other than a stub resolver on your machine (if you didn't install something, you're not), all of DNSSEC's security coalesces to a single bit in the header that says "yes, I promise, as your name server, that I actually verified signatures". I hope it's clear that a coffee shop attacker can spoof a DNS record with a single bit set. DNSSEC is full of big problems, which is why it's moribund (virtually none of the most widely-used zones have signed). But the lack of any service model in the "last mile" is probably the biggest. If you're worried about coffee shop attacks, you're looking for DoH, which actually does directly address these attacks, which, unlike cache corruption, actually occur all the time --- which is why browsers are moving to make DoH a default.
- tryauuum 5y agoLooks like you were personally hurt by DNSSEC, care to share some details?
- quotemstr 5y agoNothing stops you running a recursive resolver on your local machine. DoH is great too (provided you trust the endpoint), but what I really want is a chain of trust extending from the root to the individual DNS record, and DoH by itself doesn't give me that. But DoH sure is great for further centralizing control over internet name resolution in a few hands!
- tptacek 5y agoNothing stops you from behaving like a DNS server, that's true. But nobody is going to forklift in error-prone new DNS security infrastructure just so a couple hundred Linux nerds (hey, it me) can have a new toy to play with. What's not going to happen is for every phone in the world to run its own recursor, and that's what needs to happen for DNSSEC to work on the last mile. There are lots of problems with DNSSEC, not just this one. But if you want to have a discussion that involves things DNSSEC might help on the Internet, it's best not to start with coffee shop attacks, which are the problem DNSSEC is literally least suited to solve --- in fact, practically designed not to solve. The coffee shop problem --- or, more accurately, the wide-scale equivalent problem of ISPs behaving like malicious coffee shops --- is exactly the problem DoH addresses.
- fomine3 5y agoThat's why nowadays most web standard uses "origin" rather than "domain".
- foobar33333 5y agoDNS over HTTPS has already solved that issue.