3 ms·

This also shows a weakness in DNS. There is currently no way to validate the DNS record you’re being served is what the person hosting the website intende

by lambda 13y ago

This also shows a weakness in DNS. There is currently no way to validate the DNS record you’re being served is what the person hosting the website intended. That's what DNSSEC is for, but it hasn't become pervasive enough yet to be able to depend on it.

rwg 13y ago
Strangely enough, the largest deployment of DNSSEC-enabled, customer-facing, recursive/caching nameservers in the United States is... Comcast. That's right, the same Comcast that, back in 2009, hijacked NXDOMAIN responses by default and returned A records pointing to servers that served up advertisement-laden search pages over http.
- jasoncartwright 13y ago
  I was also impressed to see that my Comcast connection uses IPv6. Turns out they have (or will have) one of the the largest IPv6 network in the world - http://gigaom.com/2013/11/27/comcast-xfinity-broadband-is-now-one-the-largest-ipv6-network/ http://gigaom.com/2013/11/27/comcast-xfinity-broadband-is-no...
  - X-Istence 13y ago
    Comcast's IPv6 network for content from Netflix or YouTube is actually better than using IPv4. A while back I set up an IPv6 only machine just to see the difference, and it is night and day. That being said, their network still leaves something to be desired, the IPv6 routes taken to get to the same IPv6/IPv4 host can sometimes be circuitous and I have noticed that they have a higher latency too. So there are upsides and downsides, but I hope it can only get better with time!
IvyMike 13y ago
Sadly DNSSEC kinda sucks. Here's some earlier discussion on HN, with a lot of links. (Namedrop: tptacek is against DNSSEC and talks about it in the link.) https://news.ycombinator.com/item?id=5937004 https://news.ycombinator.com/item?id=5937004 TLDR: DNSSEC is kinda complex and hacko, doesn't protect you as much as you might think, and introduces a whole new PKI that you should probably trust even less than the current ones. But read the links above for the real story. I'm using DNSCrypt right now, which (correct me if I'm wrong) protects against DNS interception by my ISP, and seems like a whole lot less trouble than DNSSEC.
- graylights 13y ago
  DNScrypt only protects from your host to your nameserver. Your nameserver can still be poisoned as it queries other nameservers. dnssec protects mostly from poisoning between nameservers. It does little to protect between a host and their namserver. But in reality dnssec is not a solution, it's a problem. It will never be adopted in a meaningful way without major overhaul in spec.
- mike-cardwell 13y ago
  "protects against DNS interception by my ISP" Your ISP can still see the IP address of every web server that you connect to, and can still see the "Host" header that your browser sends in HTTP requests, and also in HTTPS requests (due to SNI) if you're using a reasonably modern OS/Browser combo. All you've done is add an additional third party that can view and log what you're doing.
  - ars_technician 13y ago
    >All you've done is add an additional third party that can view and log what you're doing. You forgot the part where it's protecting against trashy ISPs like the one in this article.
    - mike-cardwell 13y ago
      I did not forget that. The privacy lost is worse than the supposed "protection" gained by using DNSCrypt. "Trashy" ISPs can (and do) still intercept and modify the HTTP traffic even if they can't intercept and modify the DNS traffic.

by lambda 13y ago

rwg 13y ago

Strangely enough, the largest deployment of DNSSEC-enabled, customer-facing, recursive/caching nameservers in the United States is... Comcast. That's right, the same Comcast that, back in 2009, hijacked NXDOMAIN responses by default and returned A records pointing to servers that served up advertisement-laden search pages over http.

jasoncartwright 13y ago
I was also impressed to see that my Comcast connection uses IPv6. Turns out they have (or will have) one of the the largest IPv6 network in the world - http://gigaom.com/2013/11/27/comcast-xfinity-broadband-is-now-one-the-largest-ipv6-network/ http://gigaom.com/2013/11/27/comcast-xfinity-broadband-is-no...
- X-Istence 13y ago
  Comcast's IPv6 network for content from Netflix or YouTube is actually better than using IPv4. A while back I set up an IPv6 only machine just to see the difference, and it is night and day. That being said, their network still leaves something to be desired, the IPv6 routes taken to get to the same IPv6/IPv4 host can sometimes be circuitous and I have noticed that they have a higher latency too. So there are upsides and downsides, but I hope it can only get better with time!

IvyMike 13y ago

Sadly DNSSEC kinda sucks. Here's some earlier discussion on HN, with a lot of links. (Namedrop: tptacek is against DNSSEC and talks about it in the link.) https://news.ycombinator.com/item?id=5937004 https://news.ycombinator.com/item?id=5937004 TLDR: DNSSEC is kinda complex and hacko, doesn't protect you as much as you might think, and introduces a whole new PKI that you should probably trust even less than the current ones. But read the links above for the real story. I'm using DNSCrypt right now, which (correct me if I'm wrong) protects against DNS interception by my ISP, and seems like a whole lot less trouble than DNSSEC.

graylights 13y ago
DNScrypt only protects from your host to your nameserver. Your nameserver can still be poisoned as it queries other nameservers. dnssec protects mostly from poisoning between nameservers. It does little to protect between a host and their namserver. But in reality dnssec is not a solution, it's a problem. It will never be adopted in a meaningful way without major overhaul in spec.
mike-cardwell 13y ago
"protects against DNS interception by my ISP" Your ISP can still see the IP address of every web server that you connect to, and can still see the "Host" header that your browser sends in HTTP requests, and also in HTTPS requests (due to SNI) if you're using a reasonably modern OS/Browser combo. All you've done is add an additional third party that can view and log what you're doing.
- ars_technician 13y ago
  >All you've done is add an additional third party that can view and log what you're doing. You forgot the part where it's protecting against trashy ISPs like the one in this article.
  - mike-cardwell 13y ago
    I did not forget that. The privacy lost is worse than the supposed "protection" gained by using DNSCrypt. "Trashy" ISPs can (and do) still intercept and modify the HTTP traffic even if they can't intercept and modify the DNS traffic.