5 ms·
"DNSSEC is vital to the security of the internet." If this is true, I'm curious: in the six years since this post, what attacks or security incidents occurred
by IvyMike 5y ago
"DNSSEC is vital to the security of the internet." If this is true, I'm curious: in the six years since this post, what attacks or security incidents occurred which could have been prevented by DNSSEC?
- tptacek 5y agoZero. It is literally the case that you could publish the DNSSEC root keys to Pastebin tonight and almost nobody would even need to be paged.
- Panino 5y agoSometimes after a DNSSEC outage, DNSSEC fans will say "see, this is exactly the kind of attack DNSSEC protects us from!" Except there was no attack, just a misconfiguration (easy to do with DNSSEC).
- IvyMike 5y agoI should have added "question is for people who support the given statement". :)
- fulafel 5y agoGood question and would be interesting to hear about cases, although at least on-path attacks aren't going to make the news since they don't really reveal any unexpected weaknesses. But even for off-path attacks, non-DNSSEC cache poisoning countermeasures have everything hanging by a thread and occasionally those fail, eg like this: https://www.bleepingcomputer.com/news/security/dns-cache-poisoning-attacks-return-due-to-linux-weakness/ https://www.bleepingcomputer.com/news/security/dns-cache-poi... - this is not often the easiest way to break into something, but it's not exactly good and robust either.
- IvyMike 5y agoThe article asks: > Imagine if a DNS cache your computer (the client) had been relying on to lookup bleepingcomputer.com's IP, returned to you an incorrect IP address instead of ours? A "certificate not valid" error would let me know, or since they don't enable HSTS, in the HTTP downgrade case, my browser would at least show "not secure". Yeah there may be some UI issues but "vital to the security of the internet" this is not.
- deleted 5y ago[deleted]