3 ms·

> Fair enough.. but if you're talking to a MITM anyway, would you agree that it's game over? Don't think: 1/10,000 chance. Think: 1/1,000,000,000,000,000,000,0

> Fair enough.. but if you're talking to a MITM anyway, would you agree that it's game over? Don't think: 1/10,000 chance. Think: 1/1,000,000,000,000,000,000,000 chance. You are much more likely to die by getting run over by an airplane while walking down the road while also holding a Dalmatian over your head, than to have your DNSSEC signed domain redirected. The edge case that's being argued about NSA taking over DNSSEC is rather over done. However, if the argument is denial of requests, so as to block traffic, DNSSEC or not matters not - so the argument again -- is not about DNSSEC as a specific service or architecture.

jamiesonbecker 12y ago
You are assuming that your client OS/browser DNS resolvers have the pre-shared trust anchors for whichever root zone. That's kind of a big assumption. :) Without those, everything collapses, and even if they're there, you still might be in very real trouble and not even know it. Scenario 1: best of all worlds: you're running an awesome mythical OS (edit: or browser plugin as jocluteseh mentioned below) with up to date root keys and you're trying to get to a single zone and you know the root zone key... but the DNSSEC root key was compromised. No one knew this, because there's no way to detect. Your MITM attacker just forges everything. But you feel secure, since you have DNSSEC. ;) Scenario 2: you're running some really new fancy OS with a pre-shared DNSSEC root key and you make a query for DNSSEC for a zone that you don't have a key for. The recursor simply tells you that that zone doesn't have DNSSEC records. oops. Scenario 3: you're running a current OS without any root zone anchors at all. You make a query to your preferred recursive DNS server (probably whatever you were handed via DHCP) and it just lies to you, about everything. I don't understand your point about probabilities. In each of these scenarios, they're not a 1 in anything chance of getting owned in those circumstances.. that's a 1 in 1 chance. All it took was a MITM. To say nothing of the traffic analysis and complete lack of any sort of encryption for passive MITM's.
jocluteseh 12y ago
> You are assuming that your client OS/browser DNS resolvers have the pre-shared trust anchors for whichever root zone. That's kind of a big assumption. First: There are two arguments to be had. One is the server side, and one is the browser side. The server is going to know about the key problem if it happens. The client side browser can know, if the client is using plugins like this one: https://www.dnssec-validator.cz/ https://www.dnssec-validator.cz/ Second: Here is the root key: https://www.iana.org/dnssec/files https://www.iana.org/dnssec/files
- jamiesonbecker 12y ago
  Yep.. in a typical MITM scenario (say, at a coffeeshop or a hotel in a firesheep sort of attack), server side checks won't help you at all since the MITM recursive server could just keep spouting those lying lies :)

jamiesonbecker 12y ago

You are assuming that your client OS/browser DNS resolvers have the pre-shared trust anchors for whichever root zone. That's kind of a big assumption. :) Without those, everything collapses, and even if they're there, you still might be in very real trouble and not even know it. Scenario 1: best of all worlds: you're running an awesome mythical OS (edit: or browser plugin as jocluteseh mentioned below) with up to date root keys and you're trying to get to a single zone and you know the root zone key... but the DNSSEC root key was compromised. No one knew this, because there's no way to detect. Your MITM attacker just forges everything. But you feel secure, since you have DNSSEC. ;) Scenario 2: you're running some really new fancy OS with a pre-shared DNSSEC root key and you make a query for DNSSEC for a zone that you don't have a key for. The recursor simply tells you that that zone doesn't have DNSSEC records. oops. Scenario 3: you're running a current OS without any root zone anchors at all. You make a query to your preferred recursive DNS server (probably whatever you were handed via DHCP) and it just lies to you, about everything. I don't understand your point about probabilities. In each of these scenarios, they're not a 1 in anything chance of getting owned in those circumstances.. that's a 1 in 1 chance. All it took was a MITM. To say nothing of the traffic analysis and complete lack of any sort of encryption for passive MITM's.

jocluteseh 12y ago

> You are assuming that your client OS/browser DNS resolvers have the pre-shared trust anchors for whichever root zone. That's kind of a big assumption. First: There are two arguments to be had. One is the server side, and one is the browser side. The server is going to know about the key problem if it happens. The client side browser can know, if the client is using plugins like this one: https://www.dnssec-validator.cz/ https://www.dnssec-validator.cz/ Second: Here is the root key: https://www.iana.org/dnssec/files https://www.iana.org/dnssec/files

jamiesonbecker 12y ago
Yep.. in a typical MITM scenario (say, at a coffeeshop or a hotel in a firesheep sort of attack), server side checks won't help you at all since the MITM recursive server could just keep spouting those lying lies :)