3 ms·

"As a result, the many networks around the world that perform DNSSEC validation to ensure that customers are getting to the correct sites (versus being redirect

by st3fan 12y ago

"As a result, the many networks around the world that perform DNSSEC validation to ensure that customers are getting to the correct sites (versus being redirected to bogus sites for phishing or malware) were blocking customers from getting to the possibly bogus order.hbonow.com!" The "versus being redirected to bogus sites for phishing or malware" part here is funny. Because that generally happens when some scammer registeres hb0now.com. Not when someone is intercepting your DNS. And actually, in case of the latter, all bets are off anyways. Because client resolvers DO NOT CHECK DNSSEC. (Yes, I know you are on your custom configured Linux box or OpenBSD firewall and that DNSSEC works wonderful for you. But the majority of the internet using world with OS X or Windows behind a $15 DSL router or WiFi AP does not.) Stop. The. DNSSEC. Nonsense.

xorcist 12y ago
There have been many instances of unknown entities intercepting DNS which went unnoticed for quite some time. Hence DNSSEC.
danyork 12y ago
And actually... > And actually, in case of the latter, all bets are off anyways. Because client resolvers DO NOT CHECK DNSSEC. ... please visit APNIC's DNSSEC Statistics site where you will see that about 12% of all DNS queries globally ARE being validated by DNSSEC: http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g=0 http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g... In Sweden this is about 71%: http://stats.labs.apnic.net/dnssec/QM?o=cXAw7x1g1r1 http://stats.labs.apnic.net/dnssec/QM?o=cXAw7x1g1r1 Slovenia 67%, Estonia 55%, Denmark 48% ... on down to the USA at 23%: http://stats.labs.apnic.net/dnssec/XQ?o=cXAw7x1g1r1 http://stats.labs.apnic.net/dnssec/XQ?o=cXAw7x1g1r1 So DNSSEC validation very definitely * IS * happening out there!
- tptacek 12y ago
  This is "checking" in the sense that "everyone at Comcast was 'checking' when HBO Now broke".
- icebraining 12y ago
  Checks being made doesn't mean the clients are checking. What's the point of validating the communication between the servers if the last mile is unprotected?
  - danyork 12y ago
    > What's the point of validating the communication between the servers if the last mile is unprotected? It's all incremental ways of reducing the attack surface. Get DNSSEC validation happening at large public DNS services... then at ISPs... then on network edge devices... then into operating system (in stub resolvers) ... then perhaps into applications themselves. Each step reduces the attack surface a bit more. I wrote about this at: http://www.internetsociety.org/deploy360/resources/plan-dnssec-validation/ http://www.internetsociety.org/deploy360/resources/plan-dnss... This is why some people are using libraries like the GetDNS API to build DNSSEC validation directly into apps: https://getdnsapi.net/ https://getdnsapi.net/ And solving the "last mile" problem is exactly why the DPRIVE working group was chartered within IETF: https://datatracker.ietf.org/wg/dprive/charter/ https://datatracker.ietf.org/wg/dprive/charter/ (And anyone is welcome to contribute to the group.)

by st3fan 12y ago

xorcist 12y ago

There have been many instances of unknown entities intercepting DNS which went unnoticed for quite some time. Hence DNSSEC.

danyork 12y ago

And actually... > And actually, in case of the latter, all bets are off anyways. Because client resolvers DO NOT CHECK DNSSEC. ... please visit APNIC's DNSSEC Statistics site where you will see that about 12% of all DNS queries globally ARE being validated by DNSSEC: http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g=0 http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g... In Sweden this is about 71%: http://stats.labs.apnic.net/dnssec/QM?o=cXAw7x1g1r1 http://stats.labs.apnic.net/dnssec/QM?o=cXAw7x1g1r1 Slovenia 67%, Estonia 55%, Denmark 48% ... on down to the USA at 23%: http://stats.labs.apnic.net/dnssec/XQ?o=cXAw7x1g1r1 http://stats.labs.apnic.net/dnssec/XQ?o=cXAw7x1g1r1 So DNSSEC validation very definitely * IS * happening out there!

tptacek 12y ago
This is "checking" in the sense that "everyone at Comcast was 'checking' when HBO Now broke".
icebraining 12y ago
Checks being made doesn't mean the clients are checking. What's the point of validating the communication between the servers if the last mile is unprotected?
- danyork 12y ago
  > What's the point of validating the communication between the servers if the last mile is unprotected? It's all incremental ways of reducing the attack surface. Get DNSSEC validation happening at large public DNS services... then at ISPs... then on network edge devices... then into operating system (in stub resolvers) ... then perhaps into applications themselves. Each step reduces the attack surface a bit more. I wrote about this at: http://www.internetsociety.org/deploy360/resources/plan-dnssec-validation/ http://www.internetsociety.org/deploy360/resources/plan-dnss... This is why some people are using libraries like the GetDNS API to build DNSSEC validation directly into apps: https://getdnsapi.net/ https://getdnsapi.net/ And solving the "last mile" problem is exactly why the DPRIVE working group was chartered within IETF: https://datatracker.ietf.org/wg/dprive/charter/ https://datatracker.ietf.org/wg/dprive/charter/ (And anyone is welcome to contribute to the group.)