5 ms·

I don't think the goal would be getting everyone to pay attention, because if it is, you're absolutely correct. But if you look at it as a way to spread awaren

by IvyMike 13y ago

I don't think the goal would be getting everyone to pay attention, because if it is, you're absolutely correct. But if you look at it as a way to spread awareness to web admins, to be confronted with the question "how come we don't have the bestest type of icon", it's not so bad. A related example: I have recently been wondering how widespread DNSSEC is. I installed the DNSSEC validator chrome plugin, and now (almost) every website on the planet shows me a sad "no DNSSEC" icon. I can't help but feel that part of the low deployment of DNSSEC is because almost nobody, including web admins, gets any feedback about DNSSEC. (I am aware that there are other costs and risks to deployment.)

dfc 13y ago
I think you are painting an exagerated picture of DNSSEC deployment. Off the top of my head every gov/mil domain is signed, debian, archlinux, fedora, paypal, freebsd, icann, ietf, isc...
- IvyMike 13y ago
  I don't know--it really seems pretty rare in the sites I use day-to-day. Going over a list of popular websites (plus a few of interest to hackernews users), I don't think any of hackernews, google, reddit, github, wikipedia, facebook, yahoo, amazon, twitter, tumblr, bing, or ebay are using DNSSEC. My bank is not, nor are any of the other banks I thought of off the top of my head. Of the sites you mention, paypal is the only one that I use on any sort of a recurring basis. But it's a little weird to a DNSSEC newbie like me, so maybe you can explain. The verisign tool shows that paypal.com is using DNSSEC, but it doesn't appear that www.paypal.com itself is secured. Is the chrome plugin giving me misleading information? Is this how things are supposed to be? And a lot of US government sites have DNSSEC waivers. The first two examples I tried: cia.gov appears to not use DNSSEC: http://dnssec-debugger.verisignlabs.com/www.cia.gov http://dnssec-debugger.verisignlabs.com/www.cia.gov nsa.gov appears to not use DNSSEC: http://dnssec-debugger.verisignlabs.com/www.nsa.gov http://dnssec-debugger.verisignlabs.com/www.nsa.gov (Thank goodness the verisign tool itself IS using DNSSEC.) A long list of US .gov sites with and without working DNSSEC: http://fedv6-deployment.antd.nist.gov/cgi-bin/generate-gov http://fedv6-deployment.antd.nist.gov/cgi-bin/generate-gov (Also: nist.gov is using DNSSEC)
  - dfc 13y ago
    I am certainly not a DNSSEC expert so take my explanation with a grain of salt. Short answer www.paypal.com is a cname for an akamai box. That cname record is secure: $ unbound-host -v -t cname www.paypal.com www.paypal.com has CNAME record www.paypal.com.akadns.net. (secure) Everything falls apart when your resolver finishes the rest of the required lookups to get an IP address from akadns/akamaiedge. As I have been experimenting/researching dnssec I have often found it is useful to use verisign's tool AND sandia's dnsviz[1] tool. For the moment forget what I said about paypal's cname and compare sandia's[2] and verisign's[3] results for www.paypal.com and see if you can spot the issue. You are correct that it is a relief that verisign uses DNSSEC but if I may be so bold I think you may be wrong about why it is a relief. (I am trying to be helpful, i apologize if that sounds dickish it is not my intent) With DNSSEC (just like DNS) everything flows from the root. Verisign manages the .com tld so if they did not sign the .com you could not verify anyhost.com. The same thing can be said for DISA, GSA and PIR for .mil, .gov and .org zones respectively. As far as NIST goes they are the second least surprising DNSSEC adopter as far as the federal government goes. Because of NIST's standards function within the government they are normally at the forefront for things like this. Moreover DNSSEC is heavily reliant on accurate time and NIST is the home of the government's truechimer. However if you go down this rabbit hole you start to have some serious chicken and egg problems. [1] http://dnsviz.net/ http://dnsviz.net/ (NB: sandia's is so slow that its painful) [2] http://dnsviz.net/d/www.paypal.com/dnssec/ http://dnsviz.net/d/www.paypal.com/dnssec/ [3] http://dnssec-debugger.verisignlabs.com/www.paypal.com http://dnssec-debugger.verisignlabs.com/www.paypal.com
  - phlo 13y ago
    Since you mentioned banks, I just need to chime in: I recently (May, June) surveyed 100 european banks (in Germany, Switzerland, France, Italy, Austria), roughly selected for the 20 specimens with the greatest total assets per country. None of them have deployed DNSSEC. Most use SSL, many use EV certificates, a few go so far as to include HSTS. DNSSEC? Zero.
    - dfc 13y ago
      Do you have the dataset anywhere?
- patmcc 13y ago
  So in terms of traffic, basically 0% of the internet.
  - dfc 13y ago
    In terms of traffic no doubt. But that seems like the most ridiculous metric to use. But more importantly these are off the top of my head and my interests are not your average internet users interests (eg debian). Comcast is using DNSSEC. Google's dns (8.8.8.8) will do dnssec if requested in the query.
tptacek 13y ago
DNSSEC provides minimal value and adds significant overhead. We're better off the less it's deployed.
- IvyMike 13y ago
  If you're like me, and wishing tptacek would elaborate, it turns out he has in the past. For example, this entertaining thread from three years ago: https://news.ycombinator.com/item?id=1234567 https://news.ycombinator.com/item?id=1234567 Also, despite my earlier google queries about DNSSEC, everything I was reading was pretty dry. The magic phrase to google for is "DNSSEC sucks"--that gets you the interesting stuff. I haven't digested it yet, but in those results, this looks pretty interesting from D. J. Bernstein: http://cr.yp.to/talks/2010.12.28/slides.pdf http://cr.yp.to/talks/2010.12.28/slides.pdf
  - tptacek 13y ago
    More: https://news.ycombinator.com/item?id=5571937 https://news.ycombinator.com/item?id=5571937 https://news.ycombinator.com/item?id=4071178 https://news.ycombinator.com/item?id=4071178 https://news.ycombinator.com/item?id=2932378 https://news.ycombinator.com/item?id=2932378 I really don't like DNSSEC. I think it's a bad design that will harm the Internet.
  - damarquis 13y ago
    The a video of the talk those slides are from is online http://vimeo.com/18417770 http://vimeo.com/18417770 Worth watching even if you don't care much about DNSSEC, Bernstein is a good speaker.
- oconnore 13y ago
  I don't understand why your criticism of DNSSEC focuses on TLS vs. DNSSEC. DNS is a scalable global key-value store, and DNSSEC allows owners of namespaces to sign their own key pairs and delegate to sub-namespaces. If you can make the case that _that_ is not valuable, or how that is accomplished by other means, I am curious. But TLS vs. DNSSEC doesn't cut it. Yes, DNSSEC/DANE can make TLS work better. It provides a straightforward way to pin an entire zone tree while allowing site owner modifications. Your example of Ghadaffi and Bit.ly is silly, because the status quo is that governments already have access to CA keys able to issue for any server. Restricting to a single zone can only improve that. I don't know how you can claim NSEC3 is a grotesque hack without noting that it is equally grotesque to pretend that your DNS records are private. If I wanted to collect the BoA zone, I would setup recursive nameservers on the coffee shops' wifi within a quarter mile of their headquarters and grep the logs. Incidentally, this would work even with DNSCurve deployed.

by IvyMike 13y ago

dfc 13y ago

I think you are painting an exagerated picture of DNSSEC deployment. Off the top of my head every gov/mil domain is signed, debian, archlinux, fedora, paypal, freebsd, icann, ietf, isc...

IvyMike 13y ago
I don't know--it really seems pretty rare in the sites I use day-to-day. Going over a list of popular websites (plus a few of interest to hackernews users), I don't think any of hackernews, google, reddit, github, wikipedia, facebook, yahoo, amazon, twitter, tumblr, bing, or ebay are using DNSSEC. My bank is not, nor are any of the other banks I thought of off the top of my head. Of the sites you mention, paypal is the only one that I use on any sort of a recurring basis. But it's a little weird to a DNSSEC newbie like me, so maybe you can explain. The verisign tool shows that paypal.com is using DNSSEC, but it doesn't appear that www.paypal.com itself is secured. Is the chrome plugin giving me misleading information? Is this how things are supposed to be? And a lot of US government sites have DNSSEC waivers. The first two examples I tried: cia.gov appears to not use DNSSEC: http://dnssec-debugger.verisignlabs.com/www.cia.gov http://dnssec-debugger.verisignlabs.com/www.cia.gov nsa.gov appears to not use DNSSEC: http://dnssec-debugger.verisignlabs.com/www.nsa.gov http://dnssec-debugger.verisignlabs.com/www.nsa.gov (Thank goodness the verisign tool itself IS using DNSSEC.) A long list of US .gov sites with and without working DNSSEC: http://fedv6-deployment.antd.nist.gov/cgi-bin/generate-gov http://fedv6-deployment.antd.nist.gov/cgi-bin/generate-gov (Also: nist.gov is using DNSSEC)
- dfc 13y ago
  I am certainly not a DNSSEC expert so take my explanation with a grain of salt. Short answer www.paypal.com is a cname for an akamai box. That cname record is secure: $ unbound-host -v -t cname www.paypal.com www.paypal.com has CNAME record www.paypal.com.akadns.net. (secure) Everything falls apart when your resolver finishes the rest of the required lookups to get an IP address from akadns/akamaiedge. As I have been experimenting/researching dnssec I have often found it is useful to use verisign's tool AND sandia's dnsviz[1] tool. For the moment forget what I said about paypal's cname and compare sandia's[2] and verisign's[3] results for www.paypal.com and see if you can spot the issue. You are correct that it is a relief that verisign uses DNSSEC but if I may be so bold I think you may be wrong about why it is a relief. (I am trying to be helpful, i apologize if that sounds dickish it is not my intent) With DNSSEC (just like DNS) everything flows from the root. Verisign manages the .com tld so if they did not sign the .com you could not verify anyhost.com. The same thing can be said for DISA, GSA and PIR for .mil, .gov and .org zones respectively. As far as NIST goes they are the second least surprising DNSSEC adopter as far as the federal government goes. Because of NIST's standards function within the government they are normally at the forefront for things like this. Moreover DNSSEC is heavily reliant on accurate time and NIST is the home of the government's truechimer. However if you go down this rabbit hole you start to have some serious chicken and egg problems. [1] http://dnsviz.net/ http://dnsviz.net/ (NB: sandia's is so slow that its painful) [2] http://dnsviz.net/d/www.paypal.com/dnssec/ http://dnsviz.net/d/www.paypal.com/dnssec/ [3] http://dnssec-debugger.verisignlabs.com/www.paypal.com http://dnssec-debugger.verisignlabs.com/www.paypal.com
- phlo 13y ago
  Since you mentioned banks, I just need to chime in: I recently (May, June) surveyed 100 european banks (in Germany, Switzerland, France, Italy, Austria), roughly selected for the 20 specimens with the greatest total assets per country. None of them have deployed DNSSEC. Most use SSL, many use EV certificates, a few go so far as to include HSTS. DNSSEC? Zero.
  - dfc 13y ago
    Do you have the dataset anywhere?
patmcc 13y ago
So in terms of traffic, basically 0% of the internet.
- dfc 13y ago
  In terms of traffic no doubt. But that seems like the most ridiculous metric to use. But more importantly these are off the top of my head and my interests are not your average internet users interests (eg debian). Comcast is using DNSSEC. Google's dns (8.8.8.8) will do dnssec if requested in the query.

tptacek 13y ago

DNSSEC provides minimal value and adds significant overhead. We're better off the less it's deployed.

IvyMike 13y ago
If you're like me, and wishing tptacek would elaborate, it turns out he has in the past. For example, this entertaining thread from three years ago: https://news.ycombinator.com/item?id=1234567 https://news.ycombinator.com/item?id=1234567 Also, despite my earlier google queries about DNSSEC, everything I was reading was pretty dry. The magic phrase to google for is "DNSSEC sucks"--that gets you the interesting stuff. I haven't digested it yet, but in those results, this looks pretty interesting from D. J. Bernstein: http://cr.yp.to/talks/2010.12.28/slides.pdf http://cr.yp.to/talks/2010.12.28/slides.pdf
- tptacek 13y ago
  More: https://news.ycombinator.com/item?id=5571937 https://news.ycombinator.com/item?id=5571937 https://news.ycombinator.com/item?id=4071178 https://news.ycombinator.com/item?id=4071178 https://news.ycombinator.com/item?id=2932378 https://news.ycombinator.com/item?id=2932378 I really don't like DNSSEC. I think it's a bad design that will harm the Internet.
- damarquis 13y ago
  The a video of the talk those slides are from is online http://vimeo.com/18417770 http://vimeo.com/18417770 Worth watching even if you don't care much about DNSSEC, Bernstein is a good speaker.
oconnore 13y ago
I don't understand why your criticism of DNSSEC focuses on TLS vs. DNSSEC. DNS is a scalable global key-value store, and DNSSEC allows owners of namespaces to sign their own key pairs and delegate to sub-namespaces. If you can make the case that _that_ is not valuable, or how that is accomplished by other means, I am curious. But TLS vs. DNSSEC doesn't cut it. Yes, DNSSEC/DANE can make TLS work better. It provides a straightforward way to pin an entire zone tree while allowing site owner modifications. Your example of Ghadaffi and Bit.ly is silly, because the status quo is that governments already have access to CA keys able to issue for any server. Restricting to a single zone can only improve that. I don't know how you can claim NSEC3 is a grotesque hack without noting that it is equally grotesque to pretend that your DNS records are private. If I wanted to collect the BoA zone, I would setup recursive nameservers on the coffee shops' wifi within a quarter mile of their headquarters and grep the logs. Incidentally, this would work even with DNSCurve deployed.