4 ms·
Good question and would be interesting to hear about cases, although at least on-path attacks aren't going to make the news since they don't really reveal any u
by fulafel 5y ago
Good question and would be interesting to hear about cases, although at least on-path attacks aren't going to make the news since they don't really reveal any unexpected weaknesses.
But even for off-path attacks, non-DNSSEC cache poisoning countermeasures have everything hanging by a thread and occasionally those fail, eg like this: https://www.bleepingcomputer.com/news/security/dns-cache-poisoning-attacks-return-due-to-linux-weakness/ https://www.bleepingcomputer.com/news/security/dns-cache-poi... - this is not often the easiest way to break into something, but it's not exactly good and robust either.
- IvyMike 5y agoThe article asks: > Imagine if a DNS cache your computer (the client) had been relying on to lookup bleepingcomputer.com's IP, returned to you an incorrect IP address instead of ours? A "certificate not valid" error would let me know, or since they don't enable HSTS, in the HTTP downgrade case, my browser would at least show "not secure". Yeah there may be some UI issues but "vital to the security of the internet" this is not.
- deleted 5y ago[deleted]