3 ms·

Not argueing against ECC, but some of your scenarios seem to be outdated due to crypto. I.e software you download from the internet is often signed and hashes a

Not argueing against ECC, but some of your scenarios seem to be outdated due to crypto. I.e software you download from the internet is often signed and hashes are validated (Linux package managers, macOS developer certs). Same for DNS requests (dnssec) etc. Yes, there is still wiggle room for bitflips to cause problems, but less so than in the past.

mcesch 3y ago
DNSSEC is around the 4~5% mark in .com and .net.
- littlecranky67 3y ago
  True - my bad of referring to DNSsec; there are other ways you can use encryption for DNS resolving (by using an external DNS server that encrypts using TLS or simply by using DNS-over-HTTPs). This way you get 100% encryption of your DNS traffic (and thus tamper checks that would detect bitflips). Again, not arguing against ECC, there are valid points to want it - I just see less and less reasons in the consumer market.
  - josephg 3y ago
    Encryption and signing don't protect against memory corruption. For example, I download software from the internet then hash it. The hash matches. Before the bytes are written to disk locally, a bit flips in RAM. The corrupted data is written to disk and used. Likewise, dnssec doesn't protect you against DNS bitsquatting attacks[1] because the domain name can be changed before the DNS request is made. So the DNS response your computer makes for a-azon.com might be totally valid and signed. It can come through DoH or whatever. The problem is that your browser thought it was the response for amazon.com and chrome send a bitsquatter your amazon cookies. (Oops). [1] https://www.youtube.com/watch?v=9WcHsT97suU https://www.youtube.com/watch?v=9WcHsT97suU
    - littlecranky67 3y ago
      Well aware of all of that, but it decreases the chances if corruption (ie no corruption during download).
- iopq 3y ago
  news.ycombinator.com not included in this 4% either

mcesch 3y ago

DNSSEC is around the 4~5% mark in .com and .net.

littlecranky67 3y ago
True - my bad of referring to DNSsec; there are other ways you can use encryption for DNS resolving (by using an external DNS server that encrypts using TLS or simply by using DNS-over-HTTPs). This way you get 100% encryption of your DNS traffic (and thus tamper checks that would detect bitflips). Again, not arguing against ECC, there are valid points to want it - I just see less and less reasons in the consumer market.
- josephg 3y ago
  Encryption and signing don't protect against memory corruption. For example, I download software from the internet then hash it. The hash matches. Before the bytes are written to disk locally, a bit flips in RAM. The corrupted data is written to disk and used. Likewise, dnssec doesn't protect you against DNS bitsquatting attacks[1] because the domain name can be changed before the DNS request is made. So the DNS response your computer makes for a-azon.com might be totally valid and signed. It can come through DoH or whatever. The problem is that your browser thought it was the response for amazon.com and chrome send a bitsquatter your amazon cookies. (Oops). [1] https://www.youtube.com/watch?v=9WcHsT97suU https://www.youtube.com/watch?v=9WcHsT97suU
  - littlecranky67 3y ago
    Well aware of all of that, but it decreases the chances if corruption (ie no corruption during download).
iopq 3y ago
news.ycombinator.com not included in this 4% either