6 ms·

Do you mean, like all the DNS hijacking attacks listed here, occurring every single day for millions of users spanning multiple countries and including all the

Do you mean, like all the DNS hijacking attacks listed here, occurring every single day for millions of users spanning multiple countries and including all the consumer ISPs in Indonesia, for example? https://en.wikipedia.org/wiki/DNS_hijacking https://en.wikipedia.org/wiki/DNS_hijacking DNSSEC gives you end-to-end protection against DNS hijacking if your local resolver does DNSSEC verification and the domain being looked up uses DNSSEC. All you have to do is install a local resolver like https://www.knot-resolver.cz https://www.knot-resolver.cz which does DNSSEC verification by default. It can be configured to talk to your upstream DNS servers or some other DNS-over-TLS servers if you want (like the Cloudflare DNS servers).

tptacek 4y ago
This is the second time you've posted this on the thread. None of this has anything to do with DNSSEC. This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent (it's server-to-server, not endpoint-to-server --- the fact that you can run a server on your bespoke Linux machine isn't relevant to the analysis), and registrar ATO.
- wizeman 4y ago
  > This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent It does if you run a local caching resolver with DNSSEC validation which is what I mentioned in the post you replied to. This caching resolver works as your system resolver, i.e., it sits on your machine and acts as an intermediary between your local apps and the upstream ISP DNS servers to cache responses and also rejects any spoofed DNS response from the upstream ISP as long as the domain has DNSSEC enabled. You are only considering DNSSEC from the point of view of a stub resolver, which nowadays is more appropriate for a microcontroller-based system rather than a modern system (including things like smartphones, home routers and cheap Raspberry Pi-like machines). Note that many modern Linux systems and home routers already have caching resolvers, it's just that most of them are not DNSSEC-validating (by default, at least).
  - byhemechi 4y ago
    running a local resolver that validates DNSSEC is all well and good for the HN crowd, but for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help. also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay)
    - wizeman 4y ago
      > for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help Sorry but I don't follow. The 99.9% of people that do not know what DNS is, don't need to know what DNSSEC is either. It works regardless of whether you know what it is. All you need is for microsoft/apple to start validating DNS, like you mention below. > also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay) No, because DNSSEC doesn't prevent DNS responses from being blocked, so the governments and ISPs can continue doing that. DNSSEC validation only prevents responses from being spoofed/forged. The ISP DNS server can still refuse to answer queries if it wants. DoH is what can prevent DNS queries from being blocked, and DoH has already been implemented in Firefox and Android as far as I know. Also, DNSSEC and DoH can (and should) be implemented together, they are not mutually exclusive, rather, they complement each other, as DoH by itself doesn't protect against forgeries by the upstream DNS server.
  - akerl_ 4y ago
    Are there any existing operating systems, Linux distributions, smartphones, or routers that currently run validating local resolvers?
    - wizeman 4y ago
      Apparently systemd-resolved, which I think is the DNS resolver used on most modern Linux distros, defaults to DNSSEC=allow-downgrade, which means it will validate DNSSEC if it's working, and disable validation otherwise. Supposedly this still has some compatibility problems, which is why Fedora (at least) still has DNSSEC=no as the default, overriding the upstream systemd-resolved default. It would be great to identify and fix the majority of those compatibility problems so that DNSSEC validation could be enabled by default. Once a large enough mass of users would have DNSSEC validation enabled by default, the incentive would then be on the network operators to fix the remaining compatibility problems, as the users' devices would work just fine on other networks and they would perceive the fault to be on the incompatible network they were using, not on their device.

tptacek 4y ago

This is the second time you've posted this on the thread. None of this has anything to do with DNSSEC. This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent (it's server-to-server, not endpoint-to-server --- the fact that you can run a server on your bespoke Linux machine isn't relevant to the analysis), and registrar ATO.

wizeman 4y ago
> This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent It does if you run a local caching resolver with DNSSEC validation which is what I mentioned in the post you replied to. This caching resolver works as your system resolver, i.e., it sits on your machine and acts as an intermediary between your local apps and the upstream ISP DNS servers to cache responses and also rejects any spoofed DNS response from the upstream ISP as long as the domain has DNSSEC enabled. You are only considering DNSSEC from the point of view of a stub resolver, which nowadays is more appropriate for a microcontroller-based system rather than a modern system (including things like smartphones, home routers and cheap Raspberry Pi-like machines). Note that many modern Linux systems and home routers already have caching resolvers, it's just that most of them are not DNSSEC-validating (by default, at least).
- byhemechi 4y ago
  running a local resolver that validates DNSSEC is all well and good for the HN crowd, but for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help. also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay)
  - wizeman 4y ago
    > for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help Sorry but I don't follow. The 99.9% of people that do not know what DNS is, don't need to know what DNSSEC is either. It works regardless of whether you know what it is. All you need is for microsoft/apple to start validating DNS, like you mention below. > also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay) No, because DNSSEC doesn't prevent DNS responses from being blocked, so the governments and ISPs can continue doing that. DNSSEC validation only prevents responses from being spoofed/forged. The ISP DNS server can still refuse to answer queries if it wants. DoH is what can prevent DNS queries from being blocked, and DoH has already been implemented in Firefox and Android as far as I know. Also, DNSSEC and DoH can (and should) be implemented together, they are not mutually exclusive, rather, they complement each other, as DoH by itself doesn't protect against forgeries by the upstream DNS server.
- akerl_ 4y ago
  Are there any existing operating systems, Linux distributions, smartphones, or routers that currently run validating local resolvers?
  - wizeman 4y ago
    Apparently systemd-resolved, which I think is the DNS resolver used on most modern Linux distros, defaults to DNSSEC=allow-downgrade, which means it will validate DNSSEC if it's working, and disable validation otherwise. Supposedly this still has some compatibility problems, which is why Fedora (at least) still has DNSSEC=no as the default, overriding the upstream systemd-resolved default. It would be great to identify and fix the majority of those compatibility problems so that DNSSEC validation could be enabled by default. Once a large enough mass of users would have DNSSEC validation enabled by default, the incentive would then be on the network operators to fix the remaining compatibility problems, as the users' devices would work just fine on other networks and they would perceive the fault to be on the incompatible network they were using, not on their device.