4 ms·
As I pointed out above, DNSSEC doesn't stop this. I am not just a DNSSEC hater, but the level of misunderstanding on DNSSEC is quite large. When victim issues
by davidu 13y ago
As I pointed out above, DNSSEC doesn't stop this.
I am not just a DNSSEC hater, but the level of misunderstanding on DNSSEC is quite large.
When victim issues a query for youtube.com, I can intercept that query and hand back whatever response I want. Unless the victim KNOWS IN ADVANCE (which DNSSEC doesn't offer) that the response should be DNSSEC signed, they will accept my forged response.
DNSSEC solves problems we don't really have, and ignores the ones we do.
- wtallis 13y agoCan't you say the same thing about users who don't know to expect their connection to use TLS? What you're claiming as the problem isn't a problem with DNSSEC, but with the absence of DNSSEC. If DNSSEC were the default, then this attack couldn't happen.