3 ms·

I would say it is more a testament to the unfortunate state of cybersecurity. These "theoretical" attacks happen. Everyone just thinks it won't be them.

tptacek 1y ago
My rebuttal is that the DNSSEC root keys could hit Pastebin tonight and in almost every organization in the world nobody would need to be paged. That's not hyperbole.
- avidiax 1y ago
  You are mostly right, but I would hope that certain core security companies and organizations would get paged. Root CAs and domain registrars and such should have DNSSEC validation. Unfortunately, DNSSEC is a bit expensive in terms of support burden, additional bugs, reduced performance, etc. It will take someone like Apple turning DNSSEC validation on by default to shake out all the problems. Or it will take an exploitable vulnerability akin to SIM-swapping to maybe convince Let's Encrypt! and similar services reliant on proof-by-dns that they must require DNSSEC signing.
  - tptacek 1y ago
    SIM-swapping is a much more important attack vector than on-path/off-path traffic interception, and are closer to how DNS hijacking happens in practice (by account takeover at registrars).
    - immibis 1y ago
      Let's not fix anything other than the most popular attack, that'll be great for security. (The biggest problem in this thread is that you can bypass the rate limit but nobody else can)
      - tptacek 1y ago
        It does in fact make sense to address the most important attacks before the exotic ones, especially when addressing the exotic attacks involves drastically more work than the common ones. I think you're making my case for me.
      - saurik 1y ago
        (Click the comment to bring it up to the top-level; AFAIK, the "rate limit" you are talking about is more related to tree depth.)
        immibis 1y ago
        The rate limit is 5 comments every 4 hours.
- immibis 1y ago
  If that happened, we'd revert to pre-DNSSEC security levels: an attack would still be hard to pull off (unless you own a root DNS server or are reliably in the path to one). It's like knowing the private key for news.ycombinator.com - it still doesn't do anything unless I can impersonate the Hacker News server. But that was still enough of a risk to justify TLS on the web. Mostly because ISPs were doing it to inject ads.
  - tptacek 1y ago
    We are demonstrably in "pre-DNSSEC" security levels today. DNSSEC has almost no serious adoption.
    - iscoelho 1y ago
      That’s false. Any organization that enables DNSSEC for their domains gains its security benefits and prevents any potential DNS hijacking. At this point, your statements border on intentional dishonesty. Please be more truthful and responsible in your statements.
      - tptacek 1y ago
        This is an engineering/technical discussion and you're not going to be able to name-call your way through it.
        teddyh 1y ago
        It's funny that you of all people should say that, as I have said the same thing to you a number of times when discussing DNSSEC.
      - Avamander 1y ago
        > That’s false. Any organization that enables DNSSEC for their domains gains its security benefits and prevents any potential DNS hijacking. Hijacking by whom? Very few are really running a validating recursive resolver.

tptacek 1y ago

My rebuttal is that the DNSSEC root keys could hit Pastebin tonight and in almost every organization in the world nobody would need to be paged. That's not hyperbole.

avidiax 1y ago
You are mostly right, but I would hope that certain core security companies and organizations would get paged. Root CAs and domain registrars and such should have DNSSEC validation. Unfortunately, DNSSEC is a bit expensive in terms of support burden, additional bugs, reduced performance, etc. It will take someone like Apple turning DNSSEC validation on by default to shake out all the problems. Or it will take an exploitable vulnerability akin to SIM-swapping to maybe convince Let's Encrypt! and similar services reliant on proof-by-dns that they must require DNSSEC signing.
- tptacek 1y ago
  SIM-swapping is a much more important attack vector than on-path/off-path traffic interception, and are closer to how DNS hijacking happens in practice (by account takeover at registrars).
  - immibis 1y ago
    Let's not fix anything other than the most popular attack, that'll be great for security. (The biggest problem in this thread is that you can bypass the rate limit but nobody else can)
    - tptacek 1y ago
      It does in fact make sense to address the most important attacks before the exotic ones, especially when addressing the exotic attacks involves drastically more work than the common ones. I think you're making my case for me.
    - saurik 1y ago
      (Click the comment to bring it up to the top-level; AFAIK, the "rate limit" you are talking about is more related to tree depth.)
      - immibis 1y ago
        The rate limit is 5 comments every 4 hours.
immibis 1y ago
If that happened, we'd revert to pre-DNSSEC security levels: an attack would still be hard to pull off (unless you own a root DNS server or are reliably in the path to one). It's like knowing the private key for news.ycombinator.com - it still doesn't do anything unless I can impersonate the Hacker News server. But that was still enough of a risk to justify TLS on the web. Mostly because ISPs were doing it to inject ads.
- tptacek 1y ago
  We are demonstrably in "pre-DNSSEC" security levels today. DNSSEC has almost no serious adoption.
  - iscoelho 1y ago
    That’s false. Any organization that enables DNSSEC for their domains gains its security benefits and prevents any potential DNS hijacking. At this point, your statements border on intentional dishonesty. Please be more truthful and responsible in your statements.
    - tptacek 1y ago
      This is an engineering/technical discussion and you're not going to be able to name-call your way through it.
      - teddyh 1y ago
        It's funny that you of all people should say that, as I have said the same thing to you a number of times when discussing DNSSEC.
    - Avamander 1y ago
      > That’s false. Any organization that enables DNSSEC for their domains gains its security benefits and prevents any potential DNS hijacking. Hijacking by whom? Very few are really running a validating recursive resolver.