6 ms·

You are again ignoring the fact that DNSSEC would have prevented a $152,000 hack. Yes, we are aware organizations are not always serious about security. For tho

You are again ignoring the fact that DNSSEC would have prevented a $152,000 hack. Yes, we are aware organizations are not always serious about security. For those that are though, DNSSEC is a helpful tool.

tptacek 1y ago
No, it isn't. It attempts and mostly fails to address one ultra-exotic attack, at absolutely enormous expense, principally because the Internet standards community is so path-dependent they can't take a bad cryptosystem designed in the mid-1990s back to the drawing board. You can't just name call your way to getting this protocol adopted; people have been trying to do that for years, and the net result is that North American adoption fell. The companies you're deriding as unserious about security in general spend drastically more on security than the companies that have adopted it. No part of your argument holds up.
- iscoelho 1y ago
  "at absolutely enormous expense" Citation? A BGP hijack can be done for less than $100. "You can't just name call your way to getting this protocol adopted" I do not care if you adopt this protocol. I care that you accurately inform others of the documented risks of not adopting DNSSEC. There are organizations that can tolerate the risk. There are also organizations that are unaware because they are not accurately informed (due to individuals like yourself), and it is not covered by their security audits. That is unfortunate.
  - tptacek 1y ago
    The cost I'm talking about is the defender's.
    - iscoelho 1y ago
      [flagged]
      - tptacek 1y ago
        I'm not sure what this has to do with anything I've said on this thread, but we don't have to keep pressing these arguments; I'm pretty satisfied with the case I've made so far.
      - growse 1y ago
        Slack's house literally did burn down for 24 hours because of DNSSEC back into 2021. When you frame the risk as "marginal benefit against one specific threat" Vs "removes us from the internet for 24 hours", the big players pass and move on. This is the sort of event the phrase "sev 1" gets applied to. Some fun companies have a reg requirement to provide service on a minimum SLA, otherwise their license to operate is withdrawn. Those guys run the other way screaming when they hear things like "DNSSEC" (ask me how I know). What percentage of the fortune 500 is served over DNSSEC?
        iscoelho 1y ago
        and Slack.com still uses DNSSEC. They appear to not have come to the same conclusion.
        tptacek 1y ago
        They added DNSSEC because of FedGov accounts that require it.
        iscoelho 1y ago
        Happy to see security audits doing good work.
        psanford 1y ago
        Internally at slack the general consensus was that dnssec was a giant waste of time and money from a security perspective. We did it for compliance to sell into the Federal govt and federal contractors.
        daneel_w 1y ago

tptacek 1y ago

No, it isn't. It attempts and mostly fails to address one ultra-exotic attack, at absolutely enormous expense, principally because the Internet standards community is so path-dependent they can't take a bad cryptosystem designed in the mid-1990s back to the drawing board. You can't just name call your way to getting this protocol adopted; people have been trying to do that for years, and the net result is that North American adoption fell. The companies you're deriding as unserious about security in general spend drastically more on security than the companies that have adopted it. No part of your argument holds up.

iscoelho 1y ago
"at absolutely enormous expense" Citation? A BGP hijack can be done for less than $100. "You can't just name call your way to getting this protocol adopted" I do not care if you adopt this protocol. I care that you accurately inform others of the documented risks of not adopting DNSSEC. There are organizations that can tolerate the risk. There are also organizations that are unaware because they are not accurately informed (due to individuals like yourself), and it is not covered by their security audits. That is unfortunate.
- tptacek 1y ago
  The cost I'm talking about is the defender's.
  - iscoelho 1y ago
    [flagged]
    - tptacek 1y ago
      I'm not sure what this has to do with anything I've said on this thread, but we don't have to keep pressing these arguments; I'm pretty satisfied with the case I've made so far.
    - growse 1y ago
      Slack's house literally did burn down for 24 hours because of DNSSEC back into 2021. When you frame the risk as "marginal benefit against one specific threat" Vs "removes us from the internet for 24 hours", the big players pass and move on. This is the sort of event the phrase "sev 1" gets applied to. Some fun companies have a reg requirement to provide service on a minimum SLA, otherwise their license to operate is withdrawn. Those guys run the other way screaming when they hear things like "DNSSEC" (ask me how I know). What percentage of the fortune 500 is served over DNSSEC?
      - iscoelho 1y ago
        and Slack.com still uses DNSSEC. They appear to not have come to the same conclusion.
        tptacek 1y ago
        They added DNSSEC because of FedGov accounts that require it.
        iscoelho 1y ago
        Happy to see security audits doing good work.
        psanford 1y ago
        Internally at slack the general consensus was that dnssec was a giant waste of time and money from a security perspective. We did it for compliance to sell into the Federal govt and federal contractors.
      - daneel_w 1y ago