4 ms·
You are mostly right, but I would hope that certain core security companies and organizations would get paged. Root CAs and domain registrars and such should ha
by avidiax 1y ago
You are mostly right, but I would hope that certain core security companies and organizations would get paged. Root CAs and domain registrars and such should have DNSSEC validation.
Unfortunately, DNSSEC is a bit expensive in terms of support burden, additional bugs, reduced performance, etc. It will take someone like Apple turning DNSSEC validation on by default to shake out all the problems. Or it will take an exploitable vulnerability akin to SIM-swapping to maybe convince Let's Encrypt! and similar services reliant on proof-by-dns that they must require DNSSEC signing.
- tptacek 1y agoSIM-swapping is a much more important attack vector than on-path/off-path traffic interception, and are closer to how DNS hijacking happens in practice (by account takeover at registrars).
- immibis 1y agoLet's not fix anything other than the most popular attack, that'll be great for security. (The biggest problem in this thread is that you can bypass the rate limit but nobody else can)
- tptacek 1y agoIt does in fact make sense to address the most important attacks before the exotic ones, especially when addressing the exotic attacks involves drastically more work than the common ones. I think you're making my case for me.
- saurik 1y ago(Click the comment to bring it up to the top-level; AFAIK, the "rate limit" you are talking about is more related to tree depth.)
- immibis 1y agoThe rate limit is 5 comments every 4 hours.