5 ms·
Dan Kaminsky showed us why we need DNSSEC. Without it, it's quite easy to MITM and/or spoof network traffic. Some governments like to do this, so they'll cont
by anonymousiam 1y ago
Dan Kaminsky showed us why we need DNSSEC. Without it, it's quite easy to MITM and/or spoof network traffic. Some governments like to do this, so they'll continue to make it difficult for DNSSEC to be fully adopted.
The original registrar, Network Solutions, doesn't even fully support DNSSEC. You can only get it if you pay them an extra $5/mo and let them serve your DNS records for you. So for $5/mo you get DNSSEC, but you defer control of your records to them, which isn't really secure.
https://community.cloudflare.com/t/dnssec-on-network-solutions/354103/2 https://community.cloudflare.com/t/dnssec-on-network-solutio...
- tptacek 1y agoIt's trivial to spoof DNS even with DNSSEC set up, because DNSSEC is a server-to-server protocol. Your browser doesn't speak DNSSEC; it speaks plaintext DNS, and trusts a single bit in the response header that says whether the upstream caching resolver actually checked signatures.
- anonymousiam 1y agoYou can run your own DNSSEC-aware DNS server locally. It's not hard at all.
- tptacek 1y agoYou can run a full-feed BGP4 bird configuration on your laptop too. Sounds awesome.
- deleted 1y ago[deleted]
- ectospheno 1y agoIt is so trivial to do so you wonder why more people don’t. I’d imagine the passionate “dnssec is bad” rants some people go out of their way to post on every comment on this site might be a factor.
- tptacek 1y agoSure. Do me a favor. Call my mom and talk her through running a DNS server on her computer. I'll time you.
- anonymousiam 1y agoYour mom should be running this. It would improve her life. Set it up for her. https://pi-hole.net https://pi-hole.net