5 ms·

If a safety upgrade to driving a car made people crash their cars more, you'd call that a bug. For DNS it's a feature called DNSSEC.

gg-plz 3y ago
if your browser ignored all certificate errors, I guess you'd call that a feature?
- deleted 3y ago
  [deleted]
- tptacek 3y ago
  If your browser ignored all certificate errors, you'd have a real security problem. That's not at all the case for DNSSEC: it's possible that all of the DNSSEC root keys could hit Pastebin and nobody would really need to be paged.
  - belorn 3y ago
    Browsers did ignore most certificate errors back in the early 2000s. HTTPS sites were fairly rare and most people did not care about it or even considered https to be a negative. Many administrators considered it as bad technology that only increased instability with no obvious benefit. "Who cares about what people post to a forum?" was something I personally heard when I added https to one site. It was only really banks with plain passwords that needed https, and then external hardware devices really made https obsolete for that problem. For more fun diving into this topic, I can recommend a famous old presentation called the "Everything you Never Wanted to Know about PKI but were Forced to find out", and godzilla crypto tutorial written by the same author (Peter gutmann). The certificates in browsers has had a long history of problems and ill designs. People did not like them, and they definitively did not like them when they caused major issues.
    - teddyh 3y ago
      Links: Everything you Never Wanted to Know about PKI but were Forced to Find Out: <http://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf http://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf> Godzilla Crypto Tutorial: <https://www.cs.auckland.ac.nz/~pgut001/tutorial/ https://www.cs.auckland.ac.nz/~pgut001/tutorial/>
    - acdha 3y ago
      > Browsers did ignore most certificate errors back in the early 2000s. HTTPS sites were fairly rare and most people did not care about it or even considered https to be a negative. Many administrators considered it as bad technology that only increased instability with no obvious benefit. I’m not sure what you’re basing that on but every claim is the opposite of my experience back then. Even in the 90s it was expected that you used HTTPS for any site selling things, for example, as the credit card companies would block a business who let numbers go over the network in plaintext. Early on there were concerns about performance but that was mostly over by the turn of the century for all but large file transfers. The primary drawback was the cost of a certificate back then.
      - fomine3 3y ago
        Old certification invalid dialog was terrible. I believe most people just ignored it. https://cdn.appuals.com/wp-content/uploads/2018/11/identity-cannot-be-verified-error-message.jpg https://cdn.appuals.com/wp-content/uploads/2018/11/identity-...
        acdha 3y ago
        Yes, that’s why I found the assertion that it didn’t exist so odd since almost anyone who supported web sites or browsers back then was familiar with that dialog.
      - belorn 3y ago
        I recall well those discussions. Web stores did indeed often use https to protect credit cards. The argument was however that physical stores did not need to have similar protection, and that the issue really was with the weak security of credit cards. HTTPS was a unstable solution for a problem which people argued should had been solved with the credit card system. Physical security devices was again lifted as the future solutions to this problem. It should also be mentioned here that credit card numbers as a security token has actually slowly been phased out in favor of other forms of payment systems online, and many banks today implement additional security requirement if you pay with a credit card. Black market with stolen CC numbers, despite https use by web stores, used to be one of the biggest issues with the internet, so even with all the stores using https it wasn't a solution to that problem. I remember people talking about performance issues with https until the early 2010. "Every single micro second slower means reduced sales" was something people was very concerned about. I even heard it from people during an IETF meeting. It was talked in similar tone to how people today talk about SEO.
josephcsible 3y ago
Your analogy would only be valid for a bug that made impersonating a site easier somehow, which this one didn't.
Spooky23 3y ago
Fortunately, New Zealanders benefit from all of the problems solved by DNSSEC.
- Gigachad 3y ago
  Isn't DNSSEC basically obsoleted by DoH?
  - tptacek 3y ago
    In a sense, yes, but not so much so that DoH is a dispositive argument for deprecating it. The difference is that DoH protects transactions and DNSSEC protects the authenticity of records. It's perfectly possible for a DoH server to feed you bogus cached records; you have to trust the DoH server you're talking to, where you wouldn't have to do that if all the records on the chain of lookups you're doing are signed with DNSSEC, and you're running DNSSEC on your local system rather than a stub resolver than talks to full resolver server you have to trust (this is an uncommon set of circumstances and in practice you have exactly the same server trust problem with DNSSEC that you do with DoH). Muddying the waters further, the attacks DNSSEC protects against overlap with the ones DoH protects again, so that if the whole Internet managed to switch to DoH, you'd have bottom-up built 95% of the security feature DNSSEC is attempting to provide (DoH has massively better deployment stats than DNSSEC, so this is plausible). It's better to think of DoH as one of a catalog of different arguments that together make a clear case for sticking a fork in DNSSEC and calling it done.
    - cmeacham98 3y ago
      > DoH has massively better deployment stats than DNSSEC, so this is plausible Is this actually true where it matters? (i.e. the root servers and authoritative servers for TLDs)?
      - tptacek 3y ago
        Where what matters? On-path DNS attacks occur everywhere across the Internet, and are probably more common on the lookup side and at the edges. Certainly, the use of DoH to protect authority transactions isn't common, yet!
belorn 3y ago
Some car automatically lock their doors during driving in order to prevent hijackings, especially at red lights. Same cars has issues with drivers being locked inside if the car goes into the water. That is a bug. Is the solution to abandon locks on cars, or is the solution to fix the problem of the car doors staying locked when submerged into water? The security system by now is fairly advanced and addressing issues with accidents is a real problem. No one however would sell cars without locks.
- tptacek 3y ago
  Seems simple: we should abandon these particular car door locks, but not necessarily the concept of car door locks altogether.
  - belorn 3y ago
    If we follow this analogy further, why should we keep the concept of car doors if particular car locks can be made with bugs in them? Doesn't the possibility of bugs in locks means that there will always be a risk, even if we abandon specific locks that has demonstrated to have a bug in them?
    - tptacek 3y ago
      We should keep the locks that work and don't cause other problems, and ditch the other ones. Again, seems simple.
      - smaudet 3y ago
        Depends whether locks can be made to work. Solutions exist within problem spaces, or "paradigms", a car lock is only useful for a specific set of things i.e. deterring thieves or unwanted entry e.g. at stop lights. What I really want is a force-field to keep people and highway debris out while driving around, and a secure storage solution while not in operation. If you could sell me a force-field car with a retracting tent, and it were safer/had less issues, I might not care to have locks on my car. See also - door-less/open air vehicles. Car door locks have some pretty serious issues. There are some problems they just can't solve.
bawolff 3y ago
I'm not really a fan of dnssec, but in fairness to the analogy - car keys really do make life harder if you need to rush someone to the hospital and dont have the keys.
neurostimulant 3y ago
Maybe the cars crash more, but at least they won't take any wrong turn.

gg-plz 3y ago

if your browser ignored all certificate errors, I guess you'd call that a feature?

deleted 3y ago
[deleted]
tptacek 3y ago
If your browser ignored all certificate errors, you'd have a real security problem. That's not at all the case for DNSSEC: it's possible that all of the DNSSEC root keys could hit Pastebin and nobody would really need to be paged.
- belorn 3y ago
  Browsers did ignore most certificate errors back in the early 2000s. HTTPS sites were fairly rare and most people did not care about it or even considered https to be a negative. Many administrators considered it as bad technology that only increased instability with no obvious benefit. "Who cares about what people post to a forum?" was something I personally heard when I added https to one site. It was only really banks with plain passwords that needed https, and then external hardware devices really made https obsolete for that problem. For more fun diving into this topic, I can recommend a famous old presentation called the "Everything you Never Wanted to Know about PKI but were Forced to find out", and godzilla crypto tutorial written by the same author (Peter gutmann). The certificates in browsers has had a long history of problems and ill designs. People did not like them, and they definitively did not like them when they caused major issues.
  - teddyh 3y ago
    Links: Everything you Never Wanted to Know about PKI but were Forced to Find Out: <http://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf http://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf> Godzilla Crypto Tutorial: <https://www.cs.auckland.ac.nz/~pgut001/tutorial/ https://www.cs.auckland.ac.nz/~pgut001/tutorial/>
  - acdha 3y ago
    > Browsers did ignore most certificate errors back in the early 2000s. HTTPS sites were fairly rare and most people did not care about it or even considered https to be a negative. Many administrators considered it as bad technology that only increased instability with no obvious benefit. I’m not sure what you’re basing that on but every claim is the opposite of my experience back then. Even in the 90s it was expected that you used HTTPS for any site selling things, for example, as the credit card companies would block a business who let numbers go over the network in plaintext. Early on there were concerns about performance but that was mostly over by the turn of the century for all but large file transfers. The primary drawback was the cost of a certificate back then.
    - fomine3 3y ago
      Old certification invalid dialog was terrible. I believe most people just ignored it. https://cdn.appuals.com/wp-content/uploads/2018/11/identity-cannot-be-verified-error-message.jpg https://cdn.appuals.com/wp-content/uploads/2018/11/identity-...
      - acdha 3y ago
        Yes, that’s why I found the assertion that it didn’t exist so odd since almost anyone who supported web sites or browsers back then was familiar with that dialog.
    - belorn 3y ago
      I recall well those discussions. Web stores did indeed often use https to protect credit cards. The argument was however that physical stores did not need to have similar protection, and that the issue really was with the weak security of credit cards. HTTPS was a unstable solution for a problem which people argued should had been solved with the credit card system. Physical security devices was again lifted as the future solutions to this problem. It should also be mentioned here that credit card numbers as a security token has actually slowly been phased out in favor of other forms of payment systems online, and many banks today implement additional security requirement if you pay with a credit card. Black market with stolen CC numbers, despite https use by web stores, used to be one of the biggest issues with the internet, so even with all the stores using https it wasn't a solution to that problem. I remember people talking about performance issues with https until the early 2010. "Every single micro second slower means reduced sales" was something people was very concerned about. I even heard it from people during an IETF meeting. It was talked in similar tone to how people today talk about SEO.

josephcsible 3y ago

Your analogy would only be valid for a bug that made impersonating a site easier somehow, which this one didn't.

Spooky23 3y ago

Fortunately, New Zealanders benefit from all of the problems solved by DNSSEC.

Gigachad 3y ago
Isn't DNSSEC basically obsoleted by DoH?
- tptacek 3y ago
  In a sense, yes, but not so much so that DoH is a dispositive argument for deprecating it. The difference is that DoH protects transactions and DNSSEC protects the authenticity of records. It's perfectly possible for a DoH server to feed you bogus cached records; you have to trust the DoH server you're talking to, where you wouldn't have to do that if all the records on the chain of lookups you're doing are signed with DNSSEC, and you're running DNSSEC on your local system rather than a stub resolver than talks to full resolver server you have to trust (this is an uncommon set of circumstances and in practice you have exactly the same server trust problem with DNSSEC that you do with DoH). Muddying the waters further, the attacks DNSSEC protects against overlap with the ones DoH protects again, so that if the whole Internet managed to switch to DoH, you'd have bottom-up built 95% of the security feature DNSSEC is attempting to provide (DoH has massively better deployment stats than DNSSEC, so this is plausible). It's better to think of DoH as one of a catalog of different arguments that together make a clear case for sticking a fork in DNSSEC and calling it done.
  - cmeacham98 3y ago
    > DoH has massively better deployment stats than DNSSEC, so this is plausible Is this actually true where it matters? (i.e. the root servers and authoritative servers for TLDs)?
    - tptacek 3y ago
      Where what matters? On-path DNS attacks occur everywhere across the Internet, and are probably more common on the lookup side and at the edges. Certainly, the use of DoH to protect authority transactions isn't common, yet!

belorn 3y ago

Some car automatically lock their doors during driving in order to prevent hijackings, especially at red lights. Same cars has issues with drivers being locked inside if the car goes into the water. That is a bug. Is the solution to abandon locks on cars, or is the solution to fix the problem of the car doors staying locked when submerged into water? The security system by now is fairly advanced and addressing issues with accidents is a real problem. No one however would sell cars without locks.

tptacek 3y ago
Seems simple: we should abandon these particular car door locks, but not necessarily the concept of car door locks altogether.
- belorn 3y ago
  If we follow this analogy further, why should we keep the concept of car doors if particular car locks can be made with bugs in them? Doesn't the possibility of bugs in locks means that there will always be a risk, even if we abandon specific locks that has demonstrated to have a bug in them?
  - tptacek 3y ago
    We should keep the locks that work and don't cause other problems, and ditch the other ones. Again, seems simple.
    - smaudet 3y ago
      Depends whether locks can be made to work. Solutions exist within problem spaces, or "paradigms", a car lock is only useful for a specific set of things i.e. deterring thieves or unwanted entry e.g. at stop lights. What I really want is a force-field to keep people and highway debris out while driving around, and a secure storage solution while not in operation. If you could sell me a force-field car with a retracting tent, and it were safer/had less issues, I might not care to have locks on my car. See also - door-less/open air vehicles. Car door locks have some pretty serious issues. There are some problems they just can't solve.

bawolff 3y ago

I'm not really a fan of dnssec, but in fairness to the analogy - car keys really do make life harder if you need to rush someone to the hospital and dont have the keys.

neurostimulant 3y ago

Maybe the cars crash more, but at least they won't take any wrong turn.