5 ms·

Why/how is automatic signing of domains security theatre? As one not particularly involved, I’d have thought that was the goal, and certainly the only way you’r

Why/how is automatic signing of domains security theatre? As one not particularly involved, I’d have thought that was the goal, and certainly the only way you’re ever going to get anything but niche usage.

tptacek 3y ago
The registrar controls your keys. Further: virtually all DNS hijacking happens via registrars, not the on- and off-path network attacks on the DNS that DNSSEC attempts to defend against. (I'm focused on the stats argument here, because I feel like 'teddyh was trying to imply that I was making them up --- he only ever sees me relating them, to which I'd respond "that's because nobody else cares about DNSSEC". I have, an, uh, pretty expansive case to make against DNSSEC, but here I was just sort of relying on context 'teddyh and I share. Sorry about that!)
- alwillis 3y ago
  > The registrar controls your keys. I've been managing domains with DNSSEC for several years and I've always had control of my keys. Clarification of who controls what keys [1]: The TLD zone's private keys are managed by the company operating it. For a Country Code Top-Level Domain (ccTLD), the government of the country will be managing the key. For popular TLDs like .COM or .NET, it will be the U.S. government through the operator Verisign. For popular ccTLD .IO, it is the government of British Indian Ocean Territory. The private keys for an individual domain name are managed by the domain owner either directly or via the DNS provider hosting their domain name. With DNSSEC, it is pretty clear who controls the private keys and also keeps the risks involved distributed. Which means while China holds private keys for .cn ccTLD, it can only sign domain names under it. [1]: https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-is-needed.html https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...
  - tptacek 3y ago
    You've misunderstood the point. I'm not claiming that DNSSEC doesn't allow you to manage your own keys! I'm saying that the hundreds of thousands of auto-signed zones at registrars that just enable DNSSEC by default don't have end-user managed keys.
    - teddyh 3y ago
      How is this different from web hosting, where the web hosting provider has the HTTPS certificate?

tptacek 3y ago

The registrar controls your keys. Further: virtually all DNS hijacking happens via registrars, not the on- and off-path network attacks on the DNS that DNSSEC attempts to defend against. (I'm focused on the stats argument here, because I feel like 'teddyh was trying to imply that I was making them up --- he only ever sees me relating them, to which I'd respond "that's because nobody else cares about DNSSEC". I have, an, uh, pretty expansive case to make against DNSSEC, but here I was just sort of relying on context 'teddyh and I share. Sorry about that!)

alwillis 3y ago
> The registrar controls your keys. I've been managing domains with DNSSEC for several years and I've always had control of my keys. Clarification of who controls what keys [1]: The TLD zone's private keys are managed by the company operating it. For a Country Code Top-Level Domain (ccTLD), the government of the country will be managing the key. For popular TLDs like .COM or .NET, it will be the U.S. government through the operator Verisign. For popular ccTLD .IO, it is the government of British Indian Ocean Territory. The private keys for an individual domain name are managed by the domain owner either directly or via the DNS provider hosting their domain name. With DNSSEC, it is pretty clear who controls the private keys and also keeps the risks involved distributed. Which means while China holds private keys for .cn ccTLD, it can only sign domain names under it. [1]: https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-is-needed.html https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...
- tptacek 3y ago
  You've misunderstood the point. I'm not claiming that DNSSEC doesn't allow you to manage your own keys! I'm saying that the hundreds of thousands of auto-signed zones at registrars that just enable DNSSEC by default don't have end-user managed keys.
  - teddyh 3y ago
    How is this different from web hosting, where the web hosting provider has the HTTPS certificate?