3 ms·
DNSSEC is such a nightmare. All this "how do we make this old protocol secure and private without changing it much"
by tryauuum 3y ago
DNSSEC is such a nightmare. All this "how do we make this old protocol secure and private without changing it much"
- Fnoord 3y agoIIRC the protocol is also a nightmare for potential reflection DDoS attacks. Also, the security chain is top-down, from owner of the TLD to the domain to the resolver to the client. With DNS over TLS and DNSCurve, you have it the other way around.
- naniwaduni 3y agoDNSSEC does absolutely nothing for privacy. It seeks to achieve strictly authentication and incidentally integrity.
- tryauuum 3y agowhen I said privacy I was had NSEC3 in mind. To be honest I have no idea how does it work / why is it a thing but it looks like it obfuscates (deleted?) subdomains to make it harder to enumerate them. This is why you see stuff like 15bg9l6359f5ch23e34ddua6n1rihl9h.example.org in zone file
- tptacek 3y agoRight. That doesn't really work: you can crack them like a 1990s password file, which is why there's whitelies (online-signer chaff records) to defeat that attack. Either way: it's not really what people think about when they think "privacy". It's generally the position of the architects of DNSSEC that domain names simply aren't private at all. Meanwhile: actual DNS privacy, of what domains you're visiting with your browser, is provided by DoH, not DNSSEC.