3 ms·

I too find it odd that TLS implicitly relies on DNS (ACME from letsencrypt). If someone controls your DNS they can get signed certificates. I’m optimistic lets

I too find it odd that TLS implicitly relies on DNS (ACME from letsencrypt). If someone controls your DNS they can get signed certificates. I’m optimistic letsencrypt validate dns via multiple streams (to prevent BGP hijacking) but I’ve got no evidence or proof. But that also doesn’t solve a breach of your nameservers (Godaddy has been breached) among other things. And before anyone mentions it, dnssec is dead, at least as far as I can tell.

alwillis 3y ago
DNSSEC isn’t dead; the graph of its deployment is what you’d want for any emerging technology: high and to the right [1]. The problem is DNSSEC is complicated to deploy for large organizations like Microsoft with hundreds of domains (and subdomains). Meanwhile, many domain registrars make it close to trivial to deploy DNSSEC for small and medium sized companies. [1]: https://stats.dnssec-tools.org/#/?top=dane&trend_tab=0 https://stats.dnssec-tools.org/#/?top=dane&trend_tab=0
midasuni 3y ago
Letsencrypt might but zerossl have suffered from BGP hacks before https://therecord.media/klayswap-crypto-users-lose-funds-after-bgp-hijack https://therecord.media/klayswap-crypto-users-lose-funds-aft...
btown 3y ago
Let's Encrypt does validate via multiple streams: https://letsencrypt.org/2020/02/19/multi-perspective-validation.html https://letsencrypt.org/2020/02/19/multi-perspective-validat... But even this is vulnerable if a strong adversary can make it seem like their compromised nameserver is the only reliable nameserver reachable over the network: https://i.blackhat.com/USA21/Wednesday-Handouts/US-21-Shulman-Lets-Attack-Lets_Encrypt.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/US-21-Shulma... An analysis from early 2023 indicates LE's default setup was suboptimal compared to a multi-cloud quorum policy, which seems like a no-brainer at their scale IMHO: https://arxiv.org/abs/2302.08000 https://arxiv.org/abs/2302.08000

alwillis 3y ago

DNSSEC isn’t dead; the graph of its deployment is what you’d want for any emerging technology: high and to the right [1]. The problem is DNSSEC is complicated to deploy for large organizations like Microsoft with hundreds of domains (and subdomains). Meanwhile, many domain registrars make it close to trivial to deploy DNSSEC for small and medium sized companies. [1]: https://stats.dnssec-tools.org/#/?top=dane&trend_tab=0 https://stats.dnssec-tools.org/#/?top=dane&trend_tab=0

midasuni 3y ago

Letsencrypt might but zerossl have suffered from BGP hacks before https://therecord.media/klayswap-crypto-users-lose-funds-after-bgp-hijack https://therecord.media/klayswap-crypto-users-lose-funds-aft...

btown 3y ago

Let's Encrypt does validate via multiple streams: https://letsencrypt.org/2020/02/19/multi-perspective-validation.html https://letsencrypt.org/2020/02/19/multi-perspective-validat... But even this is vulnerable if a strong adversary can make it seem like their compromised nameserver is the only reliable nameserver reachable over the network: https://i.blackhat.com/USA21/Wednesday-Handouts/US-21-Shulman-Lets-Attack-Lets_Encrypt.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/US-21-Shulma... An analysis from early 2023 indicates LE's default setup was suboptimal compared to a multi-cloud quorum policy, which seems like a no-brainer at their scale IMHO: https://arxiv.org/abs/2302.08000 https://arxiv.org/abs/2302.08000