3 ms·

Not a bad idea, TBH. Just feeling uncomfortable putting more data into DNS. DNS is not encrypted. DNSSEC is easy to bypass (or break way too often that nobody

Not a bad idea, TBH. Just feeling uncomfortable putting more data into DNS. DNS is not encrypted. DNSSEC is easy to bypass (or break way too often that nobody want to enforce it). -- but these are not w3c's problem.

kazinator 1y ago
Yes; if someone hijacks example.com's main A record, that gets caught at the SSL level. If someone hijacks example.com's cookie record, that won't be caught; they just write themselves permission to have their page access example.com's cookies. The same info could just be hosted by example.com (at some /.well-known path or whatever). The web could generate a lot of hits against that. The DNS records could be (optionally?) signed. You'd need the SSL key of the domain to check the signature.
tptacek 1y ago
DNSSEC isn't encrypted either.
pabs3 1y ago
When you say bypass, do you mean disable DNSSEC on your own computer? Or are there known vulnerabilities in DNSSEC cryptography or software?
- tptacek 1y ago
  The stub resolver on your own computer doesn't actually speak DNSSEC. It speaks normal DNS to a recursing resolver, probably at your ISP or at Google, that itself does DNSSEC validation, and then just sets a bit in the response back to you that says "this is authentic".
  - kazinator 1y ago
    Glibc supposedly has DNSSEC, but does anyone use it: https://sourceware.org/glibc/wiki/DNSSEC https://sourceware.org/glibc/wiki/DNSSEC
    - tptacek 1y ago
      That page appears to be mostly about how to trust a real recursive cache from a glibc program.
      - kazinator 1y ago
        I'd hate to be pointed to that page and tasked with designing and implementing a test plan.
  - pabs3 1y ago
    The recursing resolver is on my local system, anything else is clearly madness.
    - tptacek 1y ago
      Always fascinating to hear about how the standard configuration for every workstation Linux distro, macOS, and Windows 10 are "clearly madness". Do go on!

kazinator 1y ago

Yes; if someone hijacks example.com's main A record, that gets caught at the SSL level. If someone hijacks example.com's cookie record, that won't be caught; they just write themselves permission to have their page access example.com's cookies. The same info could just be hosted by example.com (at some /.well-known path or whatever). The web could generate a lot of hits against that. The DNS records could be (optionally?) signed. You'd need the SSL key of the domain to check the signature.

tptacek 1y ago

DNSSEC isn't encrypted either.

pabs3 1y ago

When you say bypass, do you mean disable DNSSEC on your own computer? Or are there known vulnerabilities in DNSSEC cryptography or software?

tptacek 1y ago
The stub resolver on your own computer doesn't actually speak DNSSEC. It speaks normal DNS to a recursing resolver, probably at your ISP or at Google, that itself does DNSSEC validation, and then just sets a bit in the response back to you that says "this is authentic".
- kazinator 1y ago
  Glibc supposedly has DNSSEC, but does anyone use it: https://sourceware.org/glibc/wiki/DNSSEC https://sourceware.org/glibc/wiki/DNSSEC
  - tptacek 1y ago
    That page appears to be mostly about how to trust a real recursive cache from a glibc program.
    - kazinator 1y ago
      I'd hate to be pointed to that page and tasked with designing and implementing a test plan.
- pabs3 1y ago
  The recursing resolver is on my local system, anything else is clearly madness.
  - tptacek 1y ago
    Always fascinating to hear about how the standard configuration for every workstation Linux distro, macOS, and Windows 10 are "clearly madness". Do go on!