3 ms·
It's funny how the USG might be conflicted with both an interest in DNSSEC adoption, and an interest in preventing its adoption. Less than a year ago I was hav
by anonymousiam 3y ago
It's funny how the USG might be conflicted with both an interest in DNSSEC adoption, and an interest in preventing its adoption.
Less than a year ago I was having DNS problems reaching a subnet in the spaceforce.mil domain (via AFRC Desktop Anywhere). After some troubleshooting, I determined that the DNS server for their subnet was not configured for DNSSEC and my client was configured to refuse unauthenticated resolvers. Everything worked fine once I turned off DNSSEC locally.
DNSSEC can prevent spoofing via MITM, which is something that lots of governments do, so I can see why they might not want everyone to adopt it.
On the other hand, DNSSEC can help to secure network communication, so I can see why they might want to adopt it.
- nightpool 3y ago> DNSSEC can prevent spoofing via MITM, which is something that lots of governments do, so I can see why they might not want everyone to adopt it. Only if you're NOT using HTTPS, right? In which case your traffic is already trivially spoofable, so you're not really gaining anything else by using DNSSEC there.
- tptacek 3y agoDNSSEC is literally a key escrow system for the North American TLDs. There's no conflict: the USG people who know what DNSSEC is want it bad.