4 ms·
Too bad DNSSEC isn't widely used; signing the records would prevent this from working. The government could still block the DNS requests, though.
by vijayp 13y ago
Too bad DNSSEC isn't widely used; signing the records would prevent this from working. The government could still block the DNS requests, though.
- alex1 13y agoSure, they wouldn't be able to proxy all HTTP requests through their own servers like they're doing now, but they'd still be able to do MITM attacks at the IP level. They're already messing with routes to Google Public DNS IPs so they could just as easily mess with routes to YouTube's IPs. I don't think DNSSEC is the solution in cases like this. Somehow getting everyone to use SSL for everything is a much better solution in my opinion.
- davidu 13y agoAs I pointed out above, DNSSEC doesn't stop this. I am not just a DNSSEC hater, but the level of misunderstanding on DNSSEC is quite large. When victim issues a query for youtube.com, I can intercept that query and hand back whatever response I want. Unless the victim KNOWS IN ADVANCE (which DNSSEC doesn't offer) that the response should be DNSSEC signed, they will accept my forged response. DNSSEC solves problems we don't really have, and ignores the ones we do.
- wtallis 13y agoCan't you say the same thing about users who don't know to expect their connection to use TLS? What you're claiming as the problem isn't a problem with DNSSEC, but with the absence of DNSSEC. If DNSSEC were the default, then this attack couldn't happen.