2 ms·
In the context of DNSSEC dns zones are very much enumerable. Cloudflare does amazing tricks to avoid this https://blog.cloudflare.com/black-lies/ https://blog.c
by majke 2y ago
In the context of DNSSEC dns zones are very much enumerable.
Cloudflare does amazing tricks to avoid this https://blog.cloudflare.com/black-lies/ https://blog.cloudflare.com/black-lies/
- eqvinox 2y agoCloudflare themselves gives more information here: > NSEC3 was a “close but no cigar” solution to the problem. While it’s true that it made zone walking harder, it did not make it impossible. Zone walking with NSEC3 is still possible with a dictionary attack. So, hardening it against enumerability is a question of inserting non-dictionary names.