3 ms·

That already exists and is called DANE [0]. The issue with DANE is that you must make sure the records you receive are the good ones; unfortunately bare DNS as

by rakoo 12y ago

That already exists and is called DANE [0]. The issue with DANE is that you must make sure the records you receive are the good ones; unfortunately bare DNS as we know it doesn't provide any integrity or security, so we need a way to make sure there is no spoofing... and this is exactly what DNSSEC [1] aims to provide. The problem here is that while DANE is straightforward, DNSSEC is a massive pain to implement and, most crucially, maintain, especially for domain owners. Oh and the whole security relies on a hierarchy of key signatures that takes its root in the ICANN. So, instead of having a "decentralized" world of CAs, we go back to a hyper-centralized domain where everyone depends on the good actions of the ICANN. That sucks. [0] http://tools.ietf.org/html/rfc6698 http://tools.ietf.org/html/rfc6698 [1] https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex...

xorcist 12y ago
I don't think people should be so hung up on the risk of ICANN misbehaving. While the risk is obviously there, they have actually been very Internet-friendly in their lifespan and so far managed to steer clear of both government and private sector interference. (The big exception being all the new top domains created, which is a disturbing trend but not really damaging to existing ones.) When a certain naval themed torrent site hangs on to their domain name you know things are really not that bad. The good side about a central needle's eye for decisions is that all eyes are on them. Any bad move will be caught immediately by the community and routed around. One fuck up from their side and no one would trust them with the root certificate for DNSSEC any more. Until that happens, can't we at least agree that an authenticated DNS for certificate storage is a whole lot better than the current CA system. That does not mean development on alternatives should pause for even a second, but please get those TLSA records of yours signed and published today! Only then will we at least have something to compare other proposals against. The fact that we have a central DNS root will be with us for the forseeable future. And as long as we use domain names for identity that centralization will be a thorn in the side. But that is what we use, for better or for worse.
- rakoo 12y ago
  > Any bad move will be caught immediately by the community and routed around And go where ? We don't even have an alternative when we have the time to build it, do you think we will be able to build one when everything goes down ? I agree with you that there are no viable alternative for the moment, and we should at least put those TLSA records. You will notice that I was complaining specifically about DNSSEC, not about DANE; as long as we have a secure way to transmit those TLSA records, everything is fine. A slightly better thing than what we have today would be: - Deploy those TLSA records, both in DNS servers and applications - Have everyone use its own resolver, or at the very least a resolver they really trust (if we want to benefit from the cacheability of DNS) - Transmit DNS records through a secure channel such as DNSCurve The advantage being that these are all available today with little modifications.
  - xorcist 12y ago
    I don't think we need to go somewhere else if ICANN misbehaves. That's why I wrote route around. It all depends on what the particular bad move is. Suppose they transferred control over a top domain to a US state actor. That's one of the few scenarios I can imagine that are at least within the realm of the possible. In that particular case I believe we should pressure root server operators to temporarily hold the change and get ICANN to backpedal. DNScurve is unnecesary when DNSSEC is implemented. It also has the unfortunate design to give operators of authoritative name servers the possibility to manipulate the zone. In that situation all domain name owners would be expected to run their own DNS servers. I don't think that's realistic.

by rakoo 12y ago

xorcist 12y ago

I don't think people should be so hung up on the risk of ICANN misbehaving. While the risk is obviously there, they have actually been very Internet-friendly in their lifespan and so far managed to steer clear of both government and private sector interference. (The big exception being all the new top domains created, which is a disturbing trend but not really damaging to existing ones.) When a certain naval themed torrent site hangs on to their domain name you know things are really not that bad. The good side about a central needle's eye for decisions is that all eyes are on them. Any bad move will be caught immediately by the community and routed around. One fuck up from their side and no one would trust them with the root certificate for DNSSEC any more. Until that happens, can't we at least agree that an authenticated DNS for certificate storage is a whole lot better than the current CA system. That does not mean development on alternatives should pause for even a second, but please get those TLSA records of yours signed and published today! Only then will we at least have something to compare other proposals against. The fact that we have a central DNS root will be with us for the forseeable future. And as long as we use domain names for identity that centralization will be a thorn in the side. But that is what we use, for better or for worse.

rakoo 12y ago
> Any bad move will be caught immediately by the community and routed around And go where ? We don't even have an alternative when we have the time to build it, do you think we will be able to build one when everything goes down ? I agree with you that there are no viable alternative for the moment, and we should at least put those TLSA records. You will notice that I was complaining specifically about DNSSEC, not about DANE; as long as we have a secure way to transmit those TLSA records, everything is fine. A slightly better thing than what we have today would be: - Deploy those TLSA records, both in DNS servers and applications - Have everyone use its own resolver, or at the very least a resolver they really trust (if we want to benefit from the cacheability of DNS) - Transmit DNS records through a secure channel such as DNSCurve The advantage being that these are all available today with little modifications.
- xorcist 12y ago
  I don't think we need to go somewhere else if ICANN misbehaves. That's why I wrote route around. It all depends on what the particular bad move is. Suppose they transferred control over a top domain to a US state actor. That's one of the few scenarios I can imagine that are at least within the realm of the possible. In that particular case I believe we should pressure root server operators to temporarily hold the change and get ICANN to backpedal. DNScurve is unnecesary when DNSSEC is implemented. It also has the unfortunate design to give operators of authoritative name servers the possibility to manipulate the zone. In that situation all domain name owners would be expected to run their own DNS servers. I don't think that's realistic.