7 ms·

> This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent It does if you run a local caching resolver with DNSSEC validation which is what

> This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent It does if you run a local caching resolver with DNSSEC validation which is what I mentioned in the post you replied to. This caching resolver works as your system resolver, i.e., it sits on your machine and acts as an intermediary between your local apps and the upstream ISP DNS servers to cache responses and also rejects any spoofed DNS response from the upstream ISP as long as the domain has DNSSEC enabled. You are only considering DNSSEC from the point of view of a stub resolver, which nowadays is more appropriate for a microcontroller-based system rather than a modern system (including things like smartphones, home routers and cheap Raspberry Pi-like machines). Note that many modern Linux systems and home routers already have caching resolvers, it's just that most of them are not DNSSEC-validating (by default, at least).

byhemechi 4y ago
running a local resolver that validates DNSSEC is all well and good for the HN crowd, but for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help. also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay)
- wizeman 4y ago
  > for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help Sorry but I don't follow. The 99.9% of people that do not know what DNS is, don't need to know what DNSSEC is either. It works regardless of whether you know what it is. All you need is for microsoft/apple to start validating DNS, like you mention below. > also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay) No, because DNSSEC doesn't prevent DNS responses from being blocked, so the governments and ISPs can continue doing that. DNSSEC validation only prevents responses from being spoofed/forged. The ISP DNS server can still refuse to answer queries if it wants. DoH is what can prevent DNS queries from being blocked, and DoH has already been implemented in Firefox and Android as far as I know. Also, DNSSEC and DoH can (and should) be implemented together, they are not mutually exclusive, rather, they complement each other, as DoH by itself doesn't protect against forgeries by the upstream DNS server.
akerl_ 4y ago
Are there any existing operating systems, Linux distributions, smartphones, or routers that currently run validating local resolvers?
- wizeman 4y ago
  Apparently systemd-resolved, which I think is the DNS resolver used on most modern Linux distros, defaults to DNSSEC=allow-downgrade, which means it will validate DNSSEC if it's working, and disable validation otherwise. Supposedly this still has some compatibility problems, which is why Fedora (at least) still has DNSSEC=no as the default, overriding the upstream systemd-resolved default. It would be great to identify and fix the majority of those compatibility problems so that DNSSEC validation could be enabled by default. Once a large enough mass of users would have DNSSEC validation enabled by default, the incentive would then be on the network operators to fix the remaining compatibility problems, as the users' devices would work just fine on other networks and they would perceive the fault to be on the incompatible network they were using, not on their device.
  - tptacek 4y ago
    It's worth noting here that when 'wizeman says "enough users have DNSSEC validation enabled", he's referring to a fictitious state of "DNSSEC validation" where the clients perform full recursive validation up to the roots. No mainstream operating system does that today, so when you look at statistics about the (low but significant) percentage of DNS queries done with validation enabled, bear in mind that all of those queries are done the standard way: the stub resolver does no verification itself, and the DNS server simply communicates back to the resolver that verification was done with the `AD` bit. Obviously, an ISP can simply flip the `AD` bit in any DNS response it wants to edit.
    - wizeman 4y ago
      > No mainstream operating system does that today ... by default. Doesn't mean that the software doesn't support it (by simply flipping DNSSEC=no to DNSSEC=yes in resolved.conf). It also doesn't mean they can't switch the default once most compatibility issues are solved. > Obviously, an ISP can simply flip the `AD` bit in any DNS response it wants to edit. ... which would be rejected by DNSSEC validation in the client. Besides, many DNSSEC queries are currently validated by trusted DNS servers like Cloudflare's and Google's which don't flip the `AD` bit and can communicate to the clients via a secure protocol like DNS-over-HTTPS (implemented in Firefox and Android) or DNS-over-TLS. So don't dismiss the value that it already has, even without client-side DNSSEC validation.

byhemechi 4y ago

running a local resolver that validates DNSSEC is all well and good for the HN crowd, but for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help. also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay)

wizeman 4y ago
> for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help Sorry but I don't follow. The 99.9% of people that do not know what DNS is, don't need to know what DNSSEC is either. It works regardless of whether you know what it is. All you need is for microsoft/apple to start validating DNS, like you mention below. > also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay) No, because DNSSEC doesn't prevent DNS responses from being blocked, so the governments and ISPs can continue doing that. DNSSEC validation only prevents responses from being spoofed/forged. The ISP DNS server can still refuse to answer queries if it wants. DoH is what can prevent DNS queries from being blocked, and DoH has already been implemented in Firefox and Android as far as I know. Also, DNSSEC and DoH can (and should) be implemented together, they are not mutually exclusive, rather, they complement each other, as DoH by itself doesn't protect against forgeries by the upstream DNS server.

akerl_ 4y ago

Are there any existing operating systems, Linux distributions, smartphones, or routers that currently run validating local resolvers?

wizeman 4y ago
Apparently systemd-resolved, which I think is the DNS resolver used on most modern Linux distros, defaults to DNSSEC=allow-downgrade, which means it will validate DNSSEC if it's working, and disable validation otherwise. Supposedly this still has some compatibility problems, which is why Fedora (at least) still has DNSSEC=no as the default, overriding the upstream systemd-resolved default. It would be great to identify and fix the majority of those compatibility problems so that DNSSEC validation could be enabled by default. Once a large enough mass of users would have DNSSEC validation enabled by default, the incentive would then be on the network operators to fix the remaining compatibility problems, as the users' devices would work just fine on other networks and they would perceive the fault to be on the incompatible network they were using, not on their device.
- tptacek 4y ago
  It's worth noting here that when 'wizeman says "enough users have DNSSEC validation enabled", he's referring to a fictitious state of "DNSSEC validation" where the clients perform full recursive validation up to the roots. No mainstream operating system does that today, so when you look at statistics about the (low but significant) percentage of DNS queries done with validation enabled, bear in mind that all of those queries are done the standard way: the stub resolver does no verification itself, and the DNS server simply communicates back to the resolver that verification was done with the `AD` bit. Obviously, an ISP can simply flip the `AD` bit in any DNS response it wants to edit.
  - wizeman 4y ago
    > No mainstream operating system does that today ... by default. Doesn't mean that the software doesn't support it (by simply flipping DNSSEC=no to DNSSEC=yes in resolved.conf). It also doesn't mean they can't switch the default once most compatibility issues are solved. > Obviously, an ISP can simply flip the `AD` bit in any DNS response it wants to edit. ... which would be rejected by DNSSEC validation in the client. Besides, many DNSSEC queries are currently validated by trusted DNS servers like Cloudflare's and Google's which don't flip the `AD` bit and can communicate to the clients via a secure protocol like DNS-over-HTTPS (implemented in Firefox and Android) or DNS-over-TLS. So don't dismiss the value that it already has, even without client-side DNSSEC validation.