5 ms·

> I haven't heard many alternatives (in general). From tptacek's FAQ ( http://sockpuppet.org/stuff/dnssec-qa.html http://sockpuppet.org/stuff/dnssec-qa.html ):

by IvyMike 12y ago

> I haven't heard many alternatives (in general). From tptacek's FAQ ( http://sockpuppet.org/stuff/dnssec-qa.html http://sockpuppet.org/stuff/dnssec-qa.html ): > What’s the alternative to DNSSEC? > Do nothing. The DNS does not urgently need to be secured. > All effective security on the Internet assumes that DNS lookups are unsafe. If this bothers people from a design perspective, they should consider all the other protocol interactions in TCP/IP that aren’t secure: BGP4 advertisements, IP source addresses, ARP lookups. Clearly there is some point in the TCP/IP stack where we must draw a line and say “security and privacy are built above this layer”. The argument against DNSSEC simply says the line should be drawn somewhere higher than the DNS.

danyork 12y ago
Right.... which is where I disagree with Thomas. I believe we should secure the integrity of answers from DNS. I want a DNS we can trust. I see DNSSEC as one of the many layers in any defense-in-depth security plan. Yes, I acknowledge that there are some challenges with DNSSEC deployment... but those are what a good number of us are working on fixing. I don't see "Do nothing" as a viable alternative.
- tptacek 12y ago
  Doing nothing is self-evidently viable. Virtually no business transactions in the world are protected by DNSSEC today. None ever have been. The onus is on you to demonstrate that DNSSEC is viable, because "no DNS security at all" clearly does work. You keep walking face-first into this rhetorical brick wall. If you're going to say "doing nothing isn't viable", you need to have a ready response to the extremely obvious observation that the Internet seems to function pretty OK without DNS security. It's not 1994 anymore. You can't wave your hands and suggest that the Internet is going to get more serious in 10 years and need better security. It already needs the best security it can possibly get. It's just that DNSSEC isn't part of that mix.
  - yuhong 12y ago
    I think it is unfortunate that you leave DNSCurve at the end. I think securing the DNS is a good thing regardless.
  - schoen 12y ago
    I found many of your criticisms of DNSSEC reasonable and well-informed, but the "do nothing" part puzzled me. The information security status quo isn't exactly excellent or ideal. DNS attacks (including monitoring of DNS queries) often form a part of other attacks. Many of those attacks are perhaps best mitigated at other layers, but not all have been, and at least something like query privacy can't be. (Yes, I know DNSSEC doesn't try to address query privacy, so that problem isn't an argument for DNSSEC itself.)
  - danyork 12y ago
    Thomas, as you are well aware, the Internet of 1994 was an extremely different and much smaller world. I completely agree with this: > It already needs the best security it can possibly get. It's just that I believe that DNSSEC should be part of the mix. For instance here's an example of some research out of CERT-CC back in September 2014 where hijacking of MX records is redirecting email to someone: http://www.internetsociety.org/deploy360/blog/2014/09/email-hijacking-new-research-shows-why-we-need-dnssec-now/ http://www.internetsociety.org/deploy360/blog/2014/09/email-... As far as I can see, deploying DNSSEC validation on the networks of the affected mail servers - and receiving DNSSEC-signed MX records - would prevent them from delivering mail to servers in the middle. It's things like this that I want to prevent. I want a more secure Internet - and in my view DNSSEC helps.
    - tptacek 12y ago
      I'm sorry, but I'm going to have to point out that your comment doesn't respond to mine in any way. Once again: the 2015 Internet functions with no DNS security whatsoever. BGP announcements, themselves unencrypted, aren't protected with DNSSEC. Browsers don't use DNSSEC in any way and are in fact blind to it. Email will remain insecure with or without it. Credit card transactions are protected at a layer higher than DNS, one designed to assume that the DNS would always be insecure. Why, specifically, is doing nothing to secure the DNS "not viable"?

by IvyMike 12y ago

danyork 12y ago

Right.... which is where I disagree with Thomas. I believe we should secure the integrity of answers from DNS. I want a DNS we can trust. I see DNSSEC as one of the many layers in any defense-in-depth security plan. Yes, I acknowledge that there are some challenges with DNSSEC deployment... but those are what a good number of us are working on fixing. I don't see "Do nothing" as a viable alternative.

tptacek 12y ago
Doing nothing is self-evidently viable. Virtually no business transactions in the world are protected by DNSSEC today. None ever have been. The onus is on you to demonstrate that DNSSEC is viable, because "no DNS security at all" clearly does work. You keep walking face-first into this rhetorical brick wall. If you're going to say "doing nothing isn't viable", you need to have a ready response to the extremely obvious observation that the Internet seems to function pretty OK without DNS security. It's not 1994 anymore. You can't wave your hands and suggest that the Internet is going to get more serious in 10 years and need better security. It already needs the best security it can possibly get. It's just that DNSSEC isn't part of that mix.
- yuhong 12y ago
  I think it is unfortunate that you leave DNSCurve at the end. I think securing the DNS is a good thing regardless.
- schoen 12y ago
  I found many of your criticisms of DNSSEC reasonable and well-informed, but the "do nothing" part puzzled me. The information security status quo isn't exactly excellent or ideal. DNS attacks (including monitoring of DNS queries) often form a part of other attacks. Many of those attacks are perhaps best mitigated at other layers, but not all have been, and at least something like query privacy can't be. (Yes, I know DNSSEC doesn't try to address query privacy, so that problem isn't an argument for DNSSEC itself.)
- danyork 12y ago
  Thomas, as you are well aware, the Internet of 1994 was an extremely different and much smaller world. I completely agree with this: > It already needs the best security it can possibly get. It's just that I believe that DNSSEC should be part of the mix. For instance here's an example of some research out of CERT-CC back in September 2014 where hijacking of MX records is redirecting email to someone: http://www.internetsociety.org/deploy360/blog/2014/09/email-hijacking-new-research-shows-why-we-need-dnssec-now/ http://www.internetsociety.org/deploy360/blog/2014/09/email-... As far as I can see, deploying DNSSEC validation on the networks of the affected mail servers - and receiving DNSSEC-signed MX records - would prevent them from delivering mail to servers in the middle. It's things like this that I want to prevent. I want a more secure Internet - and in my view DNSSEC helps.
  - tptacek 12y ago
    I'm sorry, but I'm going to have to point out that your comment doesn't respond to mine in any way. Once again: the 2015 Internet functions with no DNS security whatsoever. BGP announcements, themselves unencrypted, aren't protected with DNSSEC. Browsers don't use DNSSEC in any way and are in fact blind to it. Email will remain insecure with or without it. Credit card transactions are protected at a layer higher than DNS, one designed to assume that the DNS would always be insecure. Why, specifically, is doing nothing to secure the DNS "not viable"?