4 ms·

This is precisely with PROTECT-IP and E-PARASITE are horrible ideas. We need DNSSEC, and legislative efforts that'd work against it are just going to enable thi

by cheald 15y ago

This is precisely with PROTECT-IP and E-PARASITE are horrible ideas. We need DNSSEC, and legislative efforts that'd work against it are just going to enable this sort of criminal activity to continue. I hope that legislators connect the dots.

tptacek 15y ago
I don't understand what any of this has to do with DNSSEC. DNSSEC is a dubious idea; its core value proposition is to turn DNS registrars into CAs. If we had DNSSEC 5 years ago, Ghadafi's Libya could have controlled Bitly's TLS key. I also don't see what an FBI malware bust has to do with E-PARASITE, but I don't care at all about E-PARASITE in any direction, whereas I do care about DNSSEC, which I think could actually fuck up the Internet.
- bdonlan 15y ago
  It's true that DNSSEC isn't a cure-all - but it's better than a third-party SSL CA. As-is, Libya can still control bit.ly's TLS key by changing bit.ly's NS records over to servers under their control, picking a random CA and having it auto-mint some certificates, then changing it back before anyone notices. So that security issue was always there. The issue that DNSSEC fixes is where an evil (or hacked) CA creates a certificate for a domain they have not verified at all. There is no way for the true owner of the site to indicate which CA they're using, so browsers are forced to trust all of them - leaving way too many points of failure. This is actually worse than your libya issue - many governments have their own CAs, making it downright trivial to make a certificate for google or something. By tying authentication to DNS, there is a single point that needs to be compromised; you no longer have a choice of which CA to hack or coerce. And the site owner also has the ability to choose a registrar and TLD they trust, knowing that some totally unaffiliated registrar or TLD cannot intervene.
- marshray 15y ago
  Ghadafi's Libya could have controlled Bitly's TLS key A. Hosting important stuff under TLDs controlled by unstable, unfriendly governments is a dumb idea any way you slice it. B. Ghadafi's Libya did control bit.ly. Libya still does, until such time as no one will talk to it without properly-authenticated TLS. C. TLS keys are not part of DNSSEC. Some people are proposing that idea, but it's not clear if whatever might get adopted could actually usurp a decently CA signed cert served over HTTPS. It looks far more likely that CA pinning in HSTS is going to be deployed much faster than anything over DNSSEC.

by cheald 15y ago

tptacek 15y ago

I don't understand what any of this has to do with DNSSEC. DNSSEC is a dubious idea; its core value proposition is to turn DNS registrars into CAs. If we had DNSSEC 5 years ago, Ghadafi's Libya could have controlled Bitly's TLS key. I also don't see what an FBI malware bust has to do with E-PARASITE, but I don't care at all about E-PARASITE in any direction, whereas I do care about DNSSEC, which I think could actually fuck up the Internet.

bdonlan 15y ago
It's true that DNSSEC isn't a cure-all - but it's better than a third-party SSL CA. As-is, Libya can still control bit.ly's TLS key by changing bit.ly's NS records over to servers under their control, picking a random CA and having it auto-mint some certificates, then changing it back before anyone notices. So that security issue was always there. The issue that DNSSEC fixes is where an evil (or hacked) CA creates a certificate for a domain they have not verified at all. There is no way for the true owner of the site to indicate which CA they're using, so browsers are forced to trust all of them - leaving way too many points of failure. This is actually worse than your libya issue - many governments have their own CAs, making it downright trivial to make a certificate for google or something. By tying authentication to DNS, there is a single point that needs to be compromised; you no longer have a choice of which CA to hack or coerce. And the site owner also has the ability to choose a registrar and TLD they trust, knowing that some totally unaffiliated registrar or TLD cannot intervene.
marshray 15y ago
Ghadafi's Libya could have controlled Bitly's TLS key A. Hosting important stuff under TLDs controlled by unstable, unfriendly governments is a dumb idea any way you slice it. B. Ghadafi's Libya did control bit.ly. Libya still does, until such time as no one will talk to it without properly-authenticated TLS. C. TLS keys are not part of DNSSEC. Some people are proposing that idea, but it's not clear if whatever might get adopted could actually usurp a decently CA signed cert served over HTTPS. It looks far more likely that CA pinning in HSTS is going to be deployed much faster than anything over DNSSEC.