6 ms·

> Respectfully, it sounds like you haven't paid much attention to the last 10 years of browser DNSSEC integration. You are correct. That could mean I'm wrong,

> Respectfully, it sounds like you haven't paid much attention to the last 10 years of browser DNSSEC integration. You are correct. That could mean I'm wrong, but it doesn't necessarily mean so. I would be happy to know whether I'm wrong and why. > For instance: you seem shocked (disbelieving, maybe?) at the idea that browsers can't simply enable end-to-end DANE validation. Here's a thing: DNSSEC records don't even universally transit the Internet; very widely deployed middleboxes will block DNS packets that contain DNSSEC signatures or DANE records. Indeed. That is solved by DNS-over-HTTPS for which Firefox and Android already have an implementation. > There's no point in arguing this stuff, because we're operating from different premises. You read about DANE and think it's great. I know the feeling! I was a huge HPKP booster back in the day; that didn't work either. Meanwhile, one of my premises is: we can only do things that actually work, not just things we wish would work. Sure, if it wouldn't work I would accept it (although I'd like to know why). But you haven't given me a convincing argument about why it can't work. As far as I can see, in other posts you're just arguing about things DANE should solve that WebPKI doesn't. And in this post, you're just taking into account how things stand at the present and not taking into consideration what organizations like Mozilla, Google, Apple and Microsoft could do to improve the situation, which let's be clear, is absolutely unacceptable in terms of security considering we are living in the year 2022. > I understand if you feel like I'm moving the goalposts. You don't know where the goalposts are. That's OK. But I assure you: there is no need for me to move them at all; my argument just isn't far enough from the end zone to bother. Yes, I do. The goal post is having a more secure system than insecure DNS and WebPKI while also being much simpler. DNSSEC and DANE achieve that. But you say that it's preferable to have a worse, much more complex, much more insecure system just because governments can subvert DNSSEC and DANE (even though they can subvert WebPKI even more today!).

tptacek 4y ago
The situation is far less "unacceptable" than you think it is, and DNSSEC would make things worse, not better. https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/
- wizeman 4y ago
  OK, I hadn't read that post before. Some of the arguments you had already made but some I hadn't read before. But I mean, it doesn't bode well when even the first paragraph is incorrect: > All secure crypto on the Internet assumes that the DNS lookup from names to IP addresses are insecure. Securing those DNS lookups therefore enables no meaningful security. This is incorrect because if an attacker can make a DNS lookup (say for example.com) resolve to an attacker-controlled entry (and there are multiple ways to do this), the attacker can trick almost all CAs into signing a certificate for example.com, which the attacker can use to perform a MITM attack against example.com. So WebPKI fails to protect against insecure DNS. > DNSSEC is a Government-Controlled PKI This is the same "moving the goal posts" argument. The government already controls the domain system, so you wouldn't be any worse with DNSSEC and DANE than with insecure DNS and WebPKI. You'd actually be much more secure. I mean, sure, if you want to propose a security system that has all the benefits of DNSSEC and also subverts the government, feel free to do so (and good luck with that). > In a world where users rely on DANE, those governments have much of the same cryptographic authority as the CAs do now Governments would have the same authority as today. Nothing would change with that. I'm not sure why you think DNSSEC has to subvert the government when neither insecure DNS nor WebPKI does that. In fact, insecure DNS and WebPKI allow a lot more attacks from governments, as any government can attack any website in the entire world. > Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY’s TLS keys. Muammar Gaddafi could have controlled BIT.LY's TLS keys with the WebPKI system, if he wanted! Or do you think insecure DNS and the WebPKI system protects against a government hijacking a domain? It doesn't, at all! Governments routinely hijack/seize (and block) domains with the current system. > DNSSEC is Cryptographically Weak > A modern PKI would almost certainly be based on modern elliptic curve signature schemes, As far as I know DNSSEC supports elliptic curves. > But the code that handles lookups today is buried deep in the lowest levels of application network code, and is rarely if ever wired for user interface. Browsers can definitely have such a UI, they already have their own DNS caching mechanisms and whatnot. And other applications already have the same problem with TLS, this is no different with DNSSEC. > DNSSEC is harder to deploy than TLS. Yeah, I'm not sure about that. Like you said before, DNSSEC was automatically enabled by registrars in Europe for millions of customers, without them doing anything. And even when it's not automatically enabled, usually you just have to tick a box in your DNS provider and/or copy a key into your registrar. Sure, more complicated deployments are possible but the same is true for TLS. In fact, even the most basic TLS deployment requires significantly more steps than enabling DNSSEC. > In fact, it does nothing for any of the “last mile” of DNS lookups: the link between software and DNS servers. It’s a server-to-server protocol. It does if the last mile is DNS-over-HTTPS, or DNS-over-TLS, or the client does DNSSEC validation. > Even if DNSSEC was deployed universally and every zone on the Internet was signed, a coffee-shop attacker would still be able to use DNS to man-in-the-middle browsers. No, nowadays this wouldn't be a realistic scenario anymore. Clients should do DNS-over-HTTPS and/or DNS-over-TLS and/or DNSSEC validation. > DNSSEC is Unsafe It's not, you mentioned NSEC3 yourself below, while dismissing it as "bizarro", which I don't see how it can be a valid argument. > DNSSEC is Architecturally Unsound > effective security is almost invariably application-level and receives no real support from the network itself. Right, because applications do so much to enforce DNS security and handle DNS hijacks nowadays. If DNSSEC was enabled by default then applications wouldn't have to worry about DNS security and they would be just fine. But those that wanted it, could still handle it differently (like browsers). For example, by having a DANE version of openssl which would give them more information about failures. > How could US government IT not love it? Oh, why don't you ask that about the WebPKI? That's a government's dream come true, actually. With WebPKI, countries like Russia / China / Ethiopia / Somalia / Whatever can perform MITM attacks on .COM domains. Or whatever TLD they want. With DNSSEC and DANE they can't. > If you’re running systems carefully today, no security problem you have gets solved by deploying DNSSEC. Yes, because everyone is running systems so carefully today. And if no security problem gets solved by deploying DNSSEC, will you let me MITM your DNS server and we'll see what happens? Haven't CAs already demonstrated their incompetence, power abuse and inability to prevent governments from around the world from attacking domains in other countries? I really mean no offense or disrespect, but this post honestly just reads like a bunch of FUD to me...

tptacek 4y ago

The situation is far less "unacceptable" than you think it is, and DNSSEC would make things worse, not better. https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/

wizeman 4y ago
OK, I hadn't read that post before. Some of the arguments you had already made but some I hadn't read before. But I mean, it doesn't bode well when even the first paragraph is incorrect: > All secure crypto on the Internet assumes that the DNS lookup from names to IP addresses are insecure. Securing those DNS lookups therefore enables no meaningful security. This is incorrect because if an attacker can make a DNS lookup (say for example.com) resolve to an attacker-controlled entry (and there are multiple ways to do this), the attacker can trick almost all CAs into signing a certificate for example.com, which the attacker can use to perform a MITM attack against example.com. So WebPKI fails to protect against insecure DNS. > DNSSEC is a Government-Controlled PKI This is the same "moving the goal posts" argument. The government already controls the domain system, so you wouldn't be any worse with DNSSEC and DANE than with insecure DNS and WebPKI. You'd actually be much more secure. I mean, sure, if you want to propose a security system that has all the benefits of DNSSEC and also subverts the government, feel free to do so (and good luck with that). > In a world where users rely on DANE, those governments have much of the same cryptographic authority as the CAs do now Governments would have the same authority as today. Nothing would change with that. I'm not sure why you think DNSSEC has to subvert the government when neither insecure DNS nor WebPKI does that. In fact, insecure DNS and WebPKI allow a lot more attacks from governments, as any government can attack any website in the entire world. > Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY’s TLS keys. Muammar Gaddafi could have controlled BIT.LY's TLS keys with the WebPKI system, if he wanted! Or do you think insecure DNS and the WebPKI system protects against a government hijacking a domain? It doesn't, at all! Governments routinely hijack/seize (and block) domains with the current system. > DNSSEC is Cryptographically Weak > A modern PKI would almost certainly be based on modern elliptic curve signature schemes, As far as I know DNSSEC supports elliptic curves. > But the code that handles lookups today is buried deep in the lowest levels of application network code, and is rarely if ever wired for user interface. Browsers can definitely have such a UI, they already have their own DNS caching mechanisms and whatnot. And other applications already have the same problem with TLS, this is no different with DNSSEC. > DNSSEC is harder to deploy than TLS. Yeah, I'm not sure about that. Like you said before, DNSSEC was automatically enabled by registrars in Europe for millions of customers, without them doing anything. And even when it's not automatically enabled, usually you just have to tick a box in your DNS provider and/or copy a key into your registrar. Sure, more complicated deployments are possible but the same is true for TLS. In fact, even the most basic TLS deployment requires significantly more steps than enabling DNSSEC. > In fact, it does nothing for any of the “last mile” of DNS lookups: the link between software and DNS servers. It’s a server-to-server protocol. It does if the last mile is DNS-over-HTTPS, or DNS-over-TLS, or the client does DNSSEC validation. > Even if DNSSEC was deployed universally and every zone on the Internet was signed, a coffee-shop attacker would still be able to use DNS to man-in-the-middle browsers. No, nowadays this wouldn't be a realistic scenario anymore. Clients should do DNS-over-HTTPS and/or DNS-over-TLS and/or DNSSEC validation. > DNSSEC is Unsafe It's not, you mentioned NSEC3 yourself below, while dismissing it as "bizarro", which I don't see how it can be a valid argument. > DNSSEC is Architecturally Unsound > effective security is almost invariably application-level and receives no real support from the network itself. Right, because applications do so much to enforce DNS security and handle DNS hijacks nowadays. If DNSSEC was enabled by default then applications wouldn't have to worry about DNS security and they would be just fine. But those that wanted it, could still handle it differently (like browsers). For example, by having a DANE version of openssl which would give them more information about failures. > How could US government IT not love it? Oh, why don't you ask that about the WebPKI? That's a government's dream come true, actually. With WebPKI, countries like Russia / China / Ethiopia / Somalia / Whatever can perform MITM attacks on .COM domains. Or whatever TLD they want. With DNSSEC and DANE they can't. > If you’re running systems carefully today, no security problem you have gets solved by deploying DNSSEC. Yes, because everyone is running systems so carefully today. And if no security problem gets solved by deploying DNSSEC, will you let me MITM your DNS server and we'll see what happens? Haven't CAs already demonstrated their incompetence, power abuse and inability to prevent governments from around the world from attacking domains in other countries? I really mean no offense or disrespect, but this post honestly just reads like a bunch of FUD to me...