6 ms·

Last time this was posted, I asked for an example of any real-world incident which would have been prevented by DNSSEC. I have never seen one, but it would be

Last time this was posted, I asked for an example of any real-world incident which would have been prevented by DNSSEC. I have never seen one, but it would be interesting. P.S. Lots of hypothetical examples were given, but I'd like to see an actual case. P.P.S. tptacek try to hold your tongue for at least a little bit before piping in with your usual response. :)

deleted 4y ago
[deleted]
AndyMcConachie 4y ago
Read section 2.2 on MyEtherwallet. https://www.icann.org/en/system/files/files/sac-121-en.pdf https://www.icann.org/en/system/files/files/sac-121-en.pdf The attackers took over the authoritative DNS servers and answered queries with lies.
- nmjohn 4y ago
  That example involved the attacker hijacking BGP. What protection does DNSSEC provide against that attacker?
  - xtnd53 4y ago
    With DNSSEC there is an authenticated chain from the root down. Without the private key materials for a delegation a hijacker wouldn't be able to provide appropriate signatures and so resolution would fail.
wizeman 4y ago
Do you mean, like all the DNS hijacking attacks listed here, occurring every single day for millions of users spanning multiple countries and including all the consumer ISPs in Indonesia, for example? https://en.wikipedia.org/wiki/DNS_hijacking https://en.wikipedia.org/wiki/DNS_hijacking DNSSEC gives you end-to-end protection against DNS hijacking if your local resolver does DNSSEC verification and the domain being looked up uses DNSSEC. All you have to do is install a local resolver like https://www.knot-resolver.cz https://www.knot-resolver.cz which does DNSSEC verification by default. It can be configured to talk to your upstream DNS servers or some other DNS-over-TLS servers if you want (like the Cloudflare DNS servers).
- tptacek 4y ago
  This is the second time you've posted this on the thread. None of this has anything to do with DNSSEC. This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent (it's server-to-server, not endpoint-to-server --- the fact that you can run a server on your bespoke Linux machine isn't relevant to the analysis), and registrar ATO.
  - wizeman 4y ago
    > This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent It does if you run a local caching resolver with DNSSEC validation which is what I mentioned in the post you replied to. This caching resolver works as your system resolver, i.e., it sits on your machine and acts as an intermediary between your local apps and the upstream ISP DNS servers to cache responses and also rejects any spoofed DNS response from the upstream ISP as long as the domain has DNSSEC enabled. You are only considering DNSSEC from the point of view of a stub resolver, which nowadays is more appropriate for a microcontroller-based system rather than a modern system (including things like smartphones, home routers and cheap Raspberry Pi-like machines). Note that many modern Linux systems and home routers already have caching resolvers, it's just that most of them are not DNSSEC-validating (by default, at least).
    - byhemechi 4y ago
      running a local resolver that validates DNSSEC is all well and good for the HN crowd, but for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help. also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay)
      - wizeman 4y ago
        > for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help Sorry but I don't follow. The 99.9% of people that do not know what DNS is, don't need to know what DNSSEC is either. It works regardless of whether you know what it is. All you need is for microsoft/apple to start validating DNS, like you mention below. > also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay) No, because DNSSEC doesn't prevent DNS responses from being blocked, so the governments and ISPs can continue doing that. DNSSEC validation only prevents responses from being spoofed/forged. The ISP DNS server can still refuse to answer queries if it wants. DoH is what can prevent DNS queries from being blocked, and DoH has already been implemented in Firefox and Android as far as I know. Also, DNSSEC and DoH can (and should) be implemented together, they are not mutually exclusive, rather, they complement each other, as DoH by itself doesn't protect against forgeries by the upstream DNS server.

deleted 4y ago

[deleted]

AndyMcConachie 4y ago

Read section 2.2 on MyEtherwallet. https://www.icann.org/en/system/files/files/sac-121-en.pdf https://www.icann.org/en/system/files/files/sac-121-en.pdf The attackers took over the authoritative DNS servers and answered queries with lies.

nmjohn 4y ago
That example involved the attacker hijacking BGP. What protection does DNSSEC provide against that attacker?
- xtnd53 4y ago
  With DNSSEC there is an authenticated chain from the root down. Without the private key materials for a delegation a hijacker wouldn't be able to provide appropriate signatures and so resolution would fail.

wizeman 4y ago

Do you mean, like all the DNS hijacking attacks listed here, occurring every single day for millions of users spanning multiple countries and including all the consumer ISPs in Indonesia, for example? https://en.wikipedia.org/wiki/DNS_hijacking https://en.wikipedia.org/wiki/DNS_hijacking DNSSEC gives you end-to-end protection against DNS hijacking if your local resolver does DNSSEC verification and the domain being looked up uses DNSSEC. All you have to do is install a local resolver like https://www.knot-resolver.cz https://www.knot-resolver.cz which does DNSSEC verification by default. It can be configured to talk to your upstream DNS servers or some other DNS-over-TLS servers if you want (like the Cloudflare DNS servers).

tptacek 4y ago
This is the second time you've posted this on the thread. None of this has anything to do with DNSSEC. This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent (it's server-to-server, not endpoint-to-server --- the fact that you can run a server on your bespoke Linux machine isn't relevant to the analysis), and registrar ATO.
- wizeman 4y ago
  > This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent It does if you run a local caching resolver with DNSSEC validation which is what I mentioned in the post you replied to. This caching resolver works as your system resolver, i.e., it sits on your machine and acts as an intermediary between your local apps and the upstream ISP DNS servers to cache responses and also rejects any spoofed DNS response from the upstream ISP as long as the domain has DNSSEC enabled. You are only considering DNSSEC from the point of view of a stub resolver, which nowadays is more appropriate for a microcontroller-based system rather than a modern system (including things like smartphones, home routers and cheap Raspberry Pi-like machines). Note that many modern Linux systems and home routers already have caching resolvers, it's just that most of them are not DNSSEC-validating (by default, at least).
  - byhemechi 4y ago
    running a local resolver that validates DNSSEC is all well and good for the HN crowd, but for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help. also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay)
    - wizeman 4y ago
      > for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help Sorry but I don't follow. The 99.9% of people that do not know what DNS is, don't need to know what DNSSEC is either. It works regardless of whether you know what it is. All you need is for microsoft/apple to start validating DNS, like you mention below. > also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay) No, because DNSSEC doesn't prevent DNS responses from being blocked, so the governments and ISPs can continue doing that. DNSSEC validation only prevents responses from being spoofed/forged. The ISP DNS server can still refuse to answer queries if it wants. DoH is what can prevent DNS queries from being blocked, and DoH has already been implemented in Firefox and Android as far as I know. Also, DNSSEC and DoH can (and should) be implemented together, they are not mutually exclusive, rather, they complement each other, as DoH by itself doesn't protect against forgeries by the upstream DNS server.