4 ms·

If you don't want to trust DNS then don't trust DNS. All DNSSEC does is verify that the reponse you get from a DNS server is the response the domain owner wante

If you don't want to trust DNS then don't trust DNS. All DNSSEC does is verify that the reponse you get from a DNS server is the response the domain owner wanted you to receive. It's also a bit of a stretch to say that DNS is controlled by governments. I don't even know how to unpack that statement as it seems overly broad and unnuanced. When the USG wants to seize a domain they can seize a domain. DNSSEC has nothing to do with that. The USG seizes domains now, and they'll most likely seize domains if DNSSEC reaches full deployment. Whether or not DNSSEC is deployed is entirely irrelevant to any seizure of domain names by any government. I'm all for working on non-hierarchical naming systems for the Internet, but DNS is already rooted in hierarchy. We might as well have a hierarchy we can trust, so why not DNSSEC?

tptacek 12y ago
DNSSEC is a hierarchical PKI, like the CA system. Just off the root of the DNSSEC hierarchical PKI are a series of branches that are controlled entirely by world governments. I don't know how to say this any more clearly without sounding patronizing. In a DNSSEC/DANE world, the Libyan government can successfully publish a fake certificate for BIT.LY. I absolutely do not accept the premise of the question in your last sentence. No, let's not bake a trusted hierarchy into the core of the Internet, please.
- danyork 12y ago
  > DNSSEC is a hierarchical PKI, like the CA system. Just off the root of the DNSSEC hierarchical PKI are a series of branches that are controlled entirely by world governments. I am assuming you are talking about the country-code TLDs (ccTLDs) here, correct? I agree that certainly many of those ccTLDs are directly controlled by governments while many others are operated on behalf of governments. The generic TLDs (gTLDs) are different and are mostly operated by private companies operating registries under contact with ICANN. With the "new gTLD" program there are now MORE gTLDs than there are ccTLDs. > I don't know how to say this any more clearly without sounding patronizing. In a DNSSEC/DANE world, the Libyan government can successfully publish a fake certificate for BIT.LY. Simple answer - if you don't trust the Libyan gov't, don't use a .LY domain! I would argue that in DNS in general you do need to trust your parent zone. If you don't trust them, don't use them. Period.
  - rakoo 12y ago
    If you are a service provider, then yes, you can avoid using any TLD. If you're a user, you can't use bit.ly services with DNSSEC without trusting the .ly TLD, right ?
    - danyork 12y ago
      > If you're a user, you can't use bit.ly services with DNSSEC without trusting the .ly TLD, right ? True, although you can remove the "with DNSSEC" part. You can't use bit.ly (or any other .ly) without trusting the .ly TLD. Interesting, I wasn't thinking about it from the user point of view - I was thinking about it from the domain registrant who is publishing a DNS zone under .LY. But you're right that it equally applies to the end user from the client perspective.
- throwaway2048 12y ago
  >In a DNSSEC/DANE world, the Libyan government can successfully publish a fake certificate for BIT.LY. They can also do this in a non DNSSEC/DANE world, at the crudest lowest level by hijacking the domain, and then buying a new cert and clicking the confirmation email.
  - tptacek 12y ago
    Nobody is defending the status quo.
- smutticus 12y ago
  DNSSEC doesn't create or diminish any trust in ccTLDs that wasn't already there. The Libyan government has all the authority to mess with .ly, it's their ccTLD. Without DNSSEC the Libyan government can mess with .ly, and with DNSSEC the Libyan government can mess with .ly. The main difference is that with DNSSEC, if someone does mess with .ly you know it was the Libyan government. Without DNSSEC attribution of the messing-with becomes much more difficult. I think we both agree that there are innate problems with hierarchies of trust. Unfortunately, for better or for worse, we're stuck with hierarchies until something better comes along. Let's also not make perfection the enemy of good, Namecoin, or other massively distributed naming systems, might eventually develop into really interesting technologies. However, for the immediate future, we're stuck with DNS and we should make the most of it.
  - tptacek 12y ago
    No. The Libyan government does not have the authority to surreptitiously control BIT.LY. That's not how the Internet trust model works. Even in the badly broken implementation we have today, there are things BIT.LY can do to override Libya; for instance, they can have their certificate pinned to a specific trusted CA. The general belief that TLD managers "already" control sites is probably behind a lot of otherwise- inexplicable DNSSEC boosterism. Because if you really believe that, then sure, giving still more control to the operators of those TLDs is just a cosmetic change. But, thankfully: no. No, no, no. The operators of .COM don't get to monitor Google mail. The government of the British Indian Ocean Territories doesn't get to patch Redis. The schemes we have now to fence Internet trust off from TLDs are imperfect. The right response to that is to make them better. DNSSEC advocates act like this is a pipe dream, but there are surprisingly simple things we can do right now to massively improve the situation, like adopting TACK or HPKP to turn everyone's (or at least everyone running Chrome and Firefox's) browsers into a surveillance system for attempts to compromise Internet trust. "But we can do this in a DNSSEC world, too", the DNSSEC advocates say. That's not quite right; they mean to say, "but we still have to do this in a DNSSEC world". Two problems. First, if we're going to rely on HPKP/TACK and CT as a bridge to a decentralized reasonable trust system, why waste the time and effort on DNSSEC in the first place? Answer: there is no compelling reason to do that. Secondly: DNSSEC actually makes it harder to do those things; among the reasons, when TLD operators misbehave, there is no recourse at all for rectifying the situation. How long do you think it takes the Chrome team to flip the switch to remove a rogue CA? Now, how long will it take them to remove .COM?

tptacek 12y ago

DNSSEC is a hierarchical PKI, like the CA system. Just off the root of the DNSSEC hierarchical PKI are a series of branches that are controlled entirely by world governments. I don't know how to say this any more clearly without sounding patronizing. In a DNSSEC/DANE world, the Libyan government can successfully publish a fake certificate for BIT.LY. I absolutely do not accept the premise of the question in your last sentence. No, let's not bake a trusted hierarchy into the core of the Internet, please.

danyork 12y ago
> DNSSEC is a hierarchical PKI, like the CA system. Just off the root of the DNSSEC hierarchical PKI are a series of branches that are controlled entirely by world governments. I am assuming you are talking about the country-code TLDs (ccTLDs) here, correct? I agree that certainly many of those ccTLDs are directly controlled by governments while many others are operated on behalf of governments. The generic TLDs (gTLDs) are different and are mostly operated by private companies operating registries under contact with ICANN. With the "new gTLD" program there are now MORE gTLDs than there are ccTLDs. > I don't know how to say this any more clearly without sounding patronizing. In a DNSSEC/DANE world, the Libyan government can successfully publish a fake certificate for BIT.LY. Simple answer - if you don't trust the Libyan gov't, don't use a .LY domain! I would argue that in DNS in general you do need to trust your parent zone. If you don't trust them, don't use them. Period.
- rakoo 12y ago
  If you are a service provider, then yes, you can avoid using any TLD. If you're a user, you can't use bit.ly services with DNSSEC without trusting the .ly TLD, right ?
  - danyork 12y ago
    > If you're a user, you can't use bit.ly services with DNSSEC without trusting the .ly TLD, right ? True, although you can remove the "with DNSSEC" part. You can't use bit.ly (or any other .ly) without trusting the .ly TLD. Interesting, I wasn't thinking about it from the user point of view - I was thinking about it from the domain registrant who is publishing a DNS zone under .LY. But you're right that it equally applies to the end user from the client perspective.
throwaway2048 12y ago
>In a DNSSEC/DANE world, the Libyan government can successfully publish a fake certificate for BIT.LY. They can also do this in a non DNSSEC/DANE world, at the crudest lowest level by hijacking the domain, and then buying a new cert and clicking the confirmation email.
- tptacek 12y ago
  Nobody is defending the status quo.
smutticus 12y ago
DNSSEC doesn't create or diminish any trust in ccTLDs that wasn't already there. The Libyan government has all the authority to mess with .ly, it's their ccTLD. Without DNSSEC the Libyan government can mess with .ly, and with DNSSEC the Libyan government can mess with .ly. The main difference is that with DNSSEC, if someone does mess with .ly you know it was the Libyan government. Without DNSSEC attribution of the messing-with becomes much more difficult. I think we both agree that there are innate problems with hierarchies of trust. Unfortunately, for better or for worse, we're stuck with hierarchies until something better comes along. Let's also not make perfection the enemy of good, Namecoin, or other massively distributed naming systems, might eventually develop into really interesting technologies. However, for the immediate future, we're stuck with DNS and we should make the most of it.
- tptacek 12y ago
  No. The Libyan government does not have the authority to surreptitiously control BIT.LY. That's not how the Internet trust model works. Even in the badly broken implementation we have today, there are things BIT.LY can do to override Libya; for instance, they can have their certificate pinned to a specific trusted CA. The general belief that TLD managers "already" control sites is probably behind a lot of otherwise- inexplicable DNSSEC boosterism. Because if you really believe that, then sure, giving still more control to the operators of those TLDs is just a cosmetic change. But, thankfully: no. No, no, no. The operators of .COM don't get to monitor Google mail. The government of the British Indian Ocean Territories doesn't get to patch Redis. The schemes we have now to fence Internet trust off from TLDs are imperfect. The right response to that is to make them better. DNSSEC advocates act like this is a pipe dream, but there are surprisingly simple things we can do right now to massively improve the situation, like adopting TACK or HPKP to turn everyone's (or at least everyone running Chrome and Firefox's) browsers into a surveillance system for attempts to compromise Internet trust. "But we can do this in a DNSSEC world, too", the DNSSEC advocates say. That's not quite right; they mean to say, "but we still have to do this in a DNSSEC world". Two problems. First, if we're going to rely on HPKP/TACK and CT as a bridge to a decentralized reasonable trust system, why waste the time and effort on DNSSEC in the first place? Answer: there is no compelling reason to do that. Secondly: DNSSEC actually makes it harder to do those things; among the reasons, when TLD operators misbehave, there is no recourse at all for rectifying the situation. How long do you think it takes the Chrome team to flip the switch to remove a rogue CA? Now, how long will it take them to remove .COM?