3 ms·

Why should anybody? DNSSEC is almost irrelevant for the majority of domains. I've worked at a place that was pioneering it and found it over complicated and fra

Why should anybody? DNSSEC is almost irrelevant for the majority of domains. I've worked at a place that was pioneering it and found it over complicated and fragile, so haven't touched it since. If you implement it correctly you are slightly more secure but there are better ways to spend your time.

josephg 4y ago
This is a big problem. I feel like the security world is trusting DNSSEC to close the unencrypted / unsigned DNS record shaped security hole. If its not something people actually want to implement because its a mess, what do we do? Do we need something better than DNSSEC? Is DoH good enough?
teddyh 4y ago
I’ll just say that the same thing could be said (and was said, frequently and loudly) about HTTPS.
- tptacek 4y ago
  No, it wasn't. I've been working in security since 1995. People have at times said that HTTPS was unnecessary for things like static content sites and blogs, sure. There has been pushback against the idea of doing HTTPS everywhere. But no serious person has ever pushed back against the need for HTTPS in some places. HTTPS and DNSSEC are not comparable. We've spent 25 years trying to have DNSSEC and not having it, and for a lot of us, the verdict is in: DNSSEC isn't necessary for a secure Internet.
Tijdreiziger 4y ago
On the contrary; the work is only for DNS server operators (registrars). As a domain admin, you simply get DNSSEC for free if your registrar supports it. If you are instead running your own DNS server, you're probably big enough that you can afford spending some time on configuring DNSSEC.
- Avamander 4y ago
  > As a domain admin, you simply get DNSSEC for free if your registrar supports it. How is a registrar holding your keys in any aspect better than WebPKI right now? > If you are instead running your own DNS server, you're probably big enough that you can afford spending some time on configuring DNSSEC. And as the parent comment said, it's complicated and brittle, while offering little benefit. Plus you are still forced to trust your registrar, because it's doubtful you will go into the effort of interfacing with the TLD registry directly.
  - Tijdreiziger 4y ago
    > How is a registrar holding your keys in any aspect better than WebPKI right now? You can use both DNSSEC and HTTPS. And actually, if your registrar and hosting provider are the same (e.g. Cloudflare, AWS), they might hold your keys anyway.
    - Avamander 4y ago
      > And actually, if your registrar and hosting provider are the same (e.g. Cloudflare, AWS), they might hold your keys anyway. Sure, but you have the ability to choose if they're the same or not. Although an untrustworthy registrar right now would be quite bad, it wouldn't trivially compromise the security of your WebPKI TLS connections. One would not be able to say the same if we would have had deployed and built everything on top of DNSSEC+DANE.
  - naniwaduni 4y ago
    > How is a registrar holding your keys in any aspect better than WebPKI right now? In this context, the question is more "how is a registrar holding your keys in any aspect worse?" There are a couple of mostly availability-related risk models where having DNSSEC at all is probably nets negative but your registrar generally has de facto control over your domain under the no-DNSSEC PKI anyway. There is a wide range of viable use-cases where telling your registrar that yeah turn on DNSSEC is nearly free and gets you ... well, the extremely minor benefit of being able to use DNS as a verifiable public kvmap.

josephg 4y ago

This is a big problem. I feel like the security world is trusting DNSSEC to close the unencrypted / unsigned DNS record shaped security hole. If its not something people actually want to implement because its a mess, what do we do? Do we need something better than DNSSEC? Is DoH good enough?

teddyh 4y ago

I’ll just say that the same thing could be said (and was said, frequently and loudly) about HTTPS.

tptacek 4y ago
No, it wasn't. I've been working in security since 1995. People have at times said that HTTPS was unnecessary for things like static content sites and blogs, sure. There has been pushback against the idea of doing HTTPS everywhere. But no serious person has ever pushed back against the need for HTTPS in some places. HTTPS and DNSSEC are not comparable. We've spent 25 years trying to have DNSSEC and not having it, and for a lot of us, the verdict is in: DNSSEC isn't necessary for a secure Internet.

Tijdreiziger 4y ago

On the contrary; the work is only for DNS server operators (registrars). As a domain admin, you simply get DNSSEC for free if your registrar supports it. If you are instead running your own DNS server, you're probably big enough that you can afford spending some time on configuring DNSSEC.

Avamander 4y ago
> As a domain admin, you simply get DNSSEC for free if your registrar supports it. How is a registrar holding your keys in any aspect better than WebPKI right now? > If you are instead running your own DNS server, you're probably big enough that you can afford spending some time on configuring DNSSEC. And as the parent comment said, it's complicated and brittle, while offering little benefit. Plus you are still forced to trust your registrar, because it's doubtful you will go into the effort of interfacing with the TLD registry directly.
- Tijdreiziger 4y ago
  > How is a registrar holding your keys in any aspect better than WebPKI right now? You can use both DNSSEC and HTTPS. And actually, if your registrar and hosting provider are the same (e.g. Cloudflare, AWS), they might hold your keys anyway.
  - Avamander 4y ago
    > And actually, if your registrar and hosting provider are the same (e.g. Cloudflare, AWS), they might hold your keys anyway. Sure, but you have the ability to choose if they're the same or not. Although an untrustworthy registrar right now would be quite bad, it wouldn't trivially compromise the security of your WebPKI TLS connections. One would not be able to say the same if we would have had deployed and built everything on top of DNSSEC+DANE.
- naniwaduni 4y ago
  > How is a registrar holding your keys in any aspect better than WebPKI right now? In this context, the question is more "how is a registrar holding your keys in any aspect worse?" There are a couple of mostly availability-related risk models where having DNSSEC at all is probably nets negative but your registrar generally has de facto control over your domain under the no-DNSSEC PKI anyway. There is a wide range of viable use-cases where telling your registrar that yeah turn on DNSSEC is nearly free and gets you ... well, the extremely minor benefit of being able to use DNS as a verifiable public kvmap.