4 ms·
Why is DNSSEC not vulnerable to NSLs?
by akerl_ 12y ago
Why is DNSSEC not vulnerable to NSLs?
- tptacek 12y agoIt obviously is vulnerable.
- nmc 12y agoI am distinguishing on the attacker, not the means. Sorry if that was not clear. Of course DNSSEC is vulnerable to NSLs, but that is not relevant. What is relevant is: - DNSSEC is vulnerable to nation-state attacks. - The CA system is vulnerable to nation-state attacks. - The CA system is vulnerable to attacks from any CA.
- chopin 12y agoMissing points: - I, as a user, have mean to circumvent or mitigate CA issues (using certificate patrol as one possibility, certificate pinning as another,...) - There is no user work around for the DNSSEC vulnerabilities Furthermore, I'd guess that the majority of CA attacks are nation-state attacks so that both boil down to the same. I don't know of any criminal attacks (such as attacks on online banking) on the CA's. Conclusion: I, as a user, don't gain anything from DNSSEC.
- Arnt 12y agoAn NSL is secret, right? Some nation-states have the power to compel changes to the root zone, but none have the ability to do it in secret.