7 ms·

If your attacker is .COM then you already lost, with or without DNSSEC, with or without the current CA PKI system.

tptacek 4y ago
Then you've already lost, because your attacker controls .COM.
pornel 4y ago
Giving more power to a too-big-too-fail monopolist and hoping it will behave well is not a sensible system. CAs have been doing shady stuff before CT and there's no reason why they wouldn't resurrect MITM-for-cash business given DANE. With WebPKI we have multiple mutually-distrusting parties keeping each other in check. It has become a better system.
- wizeman 4y ago
  > Giving more power to a too-big-too-fail monopolist and hoping it will behave well is not a sensible system. It's not more power, it's the same power it already has! This too-big-to-fail monopolist you're talking about can already hijack your domain, regardless of whatever WebPKI does. > CAs have been doing shady stuff before CT and there's no reason why they wouldn't resurrect MITM-for-cash business given DANE. Sorry, but I don't follow. Given DANE, CAs wouldn't even exist. Unless you're talking about the transition period, which would be strictly better than what we have now, because the not-yet-transitioned domains would use WebPKI like today, while the already-transitioned domains would use DANE which has superior guarantees.
  - pornel 4y ago
    Currently Verisign can't sell certs directly, and would be caught by a CT log/report if they hijacked DNS to do this. If DANE was used, they could do whatever they want. I don't think the fact that Verisign has already too much power is a good reason to lean on them even more. I'm not talking about transition period. DANE makes TLD owners effectively a CAs. The technical details are different, but the role of root-trust-anchored private-key-holding ownership-attesting authority is the same. And unlike WebPKI CAs, browsers can't remove DNSSEC roots for abuse of trust. DANE is setting up a centralized system ripe for monopolistic abuse, where there are no checks and no consequences for fucking up. This isn't just a technical problem of a protocol for securing packets. It's also a meta problem of ensuring the organizations involved behave in a trustworthy way, even when it would be profitable to cheat, even when NSA and other 3-letter agencies put pressure on them.
    - wizeman 4y ago
      > Currently Verisign can't sell certs directly, and would be caught by a CT log/report if they hijacked DNS to do this. And then what? Like you said, browsers can't remove Verisign for abuse of trust, because Verisign isn't part of their roots of trust. And they can't remove the certificate authority who issued the certificate because 1) the certificate authority is not at fault in that scenario, and 2) Verisign could just use another one to issue a new certificate. Whatever answer you give here would apply to DANE as well. > If DANE was used, they could do whatever they want See above: they can already do whatever they want, so you wouldn't be leaning on them more than you are right now. > DANE is setting up a centralized system ripe for monopolistic abuse, where there are no checks and no consequences for fucking up. We already have a centralized system of trust, called the DNS system. It's just that currently it is still relatively insecure (DNSSEC is not widely deployed yet), so we have another fake security layer on top of it (the CA PKI system) which, because it's backed by Google and other organizations that people like so much, for some reason people trust that layer even though its security depends on the security of DNS and is actually even more flawed (since it has even more points of attack). > DANE is setting up a centralized system ripe for monopolistic abuse, where there are no checks and no consequences for fucking up. You can implement a CT-like system on top of it which would give you more transparency regarding what certificates are being used (where clients, rather than certificate authorities, would publish new certificate fingerprints to CT logs or even directly to some server managed by the domain owner). But of course, the real issue is how to deal with Verisign if it starts hijacking domains, but this is already exactly the same problem we have today with the CA PKI system.
      - tptacek 4y ago
        You cannot implement a CT-like system on top of DNS. You've said that a couple times in the thread, but ignored the reasons why it won't work for DNS. It only works in the WebPKI because browsers are able to force CAs to participate, by distrusting CAs that don't include SCTs in their signed certificates. You have to understand how CT works before you (a) dismiss it, like someone else did upthread when they claimed CAs can just ignore CT, or (b) assume it trivially ports over to DNS.

Then you've already lost, because your attacker controls .COM.

Giving more power to a too-big-too-fail monopolist and hoping it will behave well is not a sensible system. CAs have been doing shady stuff before CT and there's no reason why they wouldn't resurrect MITM-for-cash business given DANE. With WebPKI we have multiple mutually-distrusting parties keeping each other in check. It has become a better system.

wizeman 4y ago
> Giving more power to a too-big-too-fail monopolist and hoping it will behave well is not a sensible system. It's not more power, it's the same power it already has! This too-big-to-fail monopolist you're talking about can already hijack your domain, regardless of whatever WebPKI does. > CAs have been doing shady stuff before CT and there's no reason why they wouldn't resurrect MITM-for-cash business given DANE. Sorry, but I don't follow. Given DANE, CAs wouldn't even exist. Unless you're talking about the transition period, which would be strictly better than what we have now, because the not-yet-transitioned domains would use WebPKI like today, while the already-transitioned domains would use DANE which has superior guarantees.
- pornel 4y ago
  Currently Verisign can't sell certs directly, and would be caught by a CT log/report if they hijacked DNS to do this. If DANE was used, they could do whatever they want. I don't think the fact that Verisign has already too much power is a good reason to lean on them even more. I'm not talking about transition period. DANE makes TLD owners effectively a CAs. The technical details are different, but the role of root-trust-anchored private-key-holding ownership-attesting authority is the same. And unlike WebPKI CAs, browsers can't remove DNSSEC roots for abuse of trust. DANE is setting up a centralized system ripe for monopolistic abuse, where there are no checks and no consequences for fucking up. This isn't just a technical problem of a protocol for securing packets. It's also a meta problem of ensuring the organizations involved behave in a trustworthy way, even when it would be profitable to cheat, even when NSA and other 3-letter agencies put pressure on them.
  - wizeman 4y ago
    > Currently Verisign can't sell certs directly, and would be caught by a CT log/report if they hijacked DNS to do this. And then what? Like you said, browsers can't remove Verisign for abuse of trust, because Verisign isn't part of their roots of trust. And they can't remove the certificate authority who issued the certificate because 1) the certificate authority is not at fault in that scenario, and 2) Verisign could just use another one to issue a new certificate. Whatever answer you give here would apply to DANE as well. > If DANE was used, they could do whatever they want See above: they can already do whatever they want, so you wouldn't be leaning on them more than you are right now. > DANE is setting up a centralized system ripe for monopolistic abuse, where there are no checks and no consequences for fucking up. We already have a centralized system of trust, called the DNS system. It's just that currently it is still relatively insecure (DNSSEC is not widely deployed yet), so we have another fake security layer on top of it (the CA PKI system) which, because it's backed by Google and other organizations that people like so much, for some reason people trust that layer even though its security depends on the security of DNS and is actually even more flawed (since it has even more points of attack). > DANE is setting up a centralized system ripe for monopolistic abuse, where there are no checks and no consequences for fucking up. You can implement a CT-like system on top of it which would give you more transparency regarding what certificates are being used (where clients, rather than certificate authorities, would publish new certificate fingerprints to CT logs or even directly to some server managed by the domain owner). But of course, the real issue is how to deal with Verisign if it starts hijacking domains, but this is already exactly the same problem we have today with the CA PKI system.
    - tptacek 4y ago
      You cannot implement a CT-like system on top of DNS. You've said that a couple times in the thread, but ignored the reasons why it won't work for DNS. It only works in the WebPKI because browsers are able to force CAs to participate, by distrusting CAs that don't include SCTs in their signed certificates. You have to understand how CT works before you (a) dismiss it, like someone else did upthread when they claimed CAs can just ignore CT, or (b) assume it trivially ports over to DNS.