3 ms·
Who? Outside of DNS providers, which organizations would need an emergency response to the collapse of DNSSEC security? Be specific; name one. If TLS security c
by tptacek 8mo ago
Who? Outside of DNS providers, which organizations would need an emergency response to the collapse of DNSSEC security? Be specific; name one. If TLS security collapsed, I could pick a company from the Fortune 1000 at random, and they'd have an emergency response going.
- indolering 8mo agoIf DNS PKI is compromised, so is HTTPS. So yes, they would be scrambling too.
- tptacek 8mo agoThis is obviously not true.
- indolering 8mo agoDNS is where domain name authority is delegated. Anything you build on top of that is also going to be a world of hurt if it gets compromised.
- akerl_ 8mo agoSo why are we not constantly seeing real world compromises of major sites that don't use DNSSEC?
- gzread 8mo agoHere's one: https://notes.valdikss.org.ru/jabber.ru-mitm/ https://notes.valdikss.org.ru/jabber.ru-mitm/
- akerl_ 8mo agoI don't see any indication that DNSSEC would have been relevant there? Their assessment was that that interception (and certificate issuance) were completed by redirecting traffic for the legitimate IPs to another destination. The DNS records continued to work as expected.
- gzread 8mo agoYou requested: > real world compromises of major sites that don't use DNSSEC? Without any other changes to this infrastructure DNSSEC by itself wouldn't have prevented this, but it could have been combined with something else like a CAA record.
- akerl_ 8mo agoSure. I guess by that logic this attack also could have been prevented by flossing, as long as you combined flossing with setting a CAA record.
- gzread 8mo agoWithout DNSSEC, your CAA record could be spoofed.
- akerl_ 8mo agoGiven the large amount of sites, including popular sites, that do not have DNSSEC today, I'd expect that if this was a real risk we'd see a decent number of instances where it occurred. And yet I see zero. Is it possible that given other mitigations (like multi-perspective validation) and given other attack vectors (like account takeover), this isn't actually a problem?
- tptacek 8mo agoYou're doing a jazz-hands thing here where you equate a breach in DNSSEC (which virtually nobody uses), to a new susceptibility in the ordinary DNS (which everybody uses), such that an attacker could spoof arbitrary DNS lookups to arbitrary CAs. Obviously the two things aren't comparable. When you make arguments like this, or the weird SSH argument you're making across the thread, or the weird "this would be good for Wikileaks" thing you did elsewhere, you clarify how tenuous your argument is. Remember, you're in the position of arguing that 95%+ of large site operators are wrong about this, and have been for decades, and you're the one who's right. That can definitely happen! But it's an extraordinary claim and your evidence thus far is pretty terrible.