3 ms·
No. Consider that DNS request/responses are simple, cleartext UDP packets. There's DNSSEC of course but nobody uses it (and also most security experts don't li
by chetanahuja 12y ago
No. Consider that DNS request/responses are simple, cleartext UDP packets. There's DNSSEC of course but nobody uses it (and also most security experts don't like it).
- xorcist 12y agoThat's a bit silly, considering it was developed over a ten year process, and a lot of security professionals had a hand in its design. There are problems with it, which some people are quick to point out, and it is important to be aware of them. The fact that your DNS data is enumerable is an important change, for example. You could compare it to IPsec, which is what most VPNs use, which is comparable in security and design. They both, together with SSL, suffer from a bad case of design-by-committee, including atrocities like X509. DNSSEC did get an important thing right. You are in full control of your own keys, and your DNS provider can not impersonate you. Having an external DNS hosting provider was not common back then, but it is now, and I'm glad they got that right.
- indymike 12y agoIf experts take 10 years to make a product that sucks, the product still sucks.
- xorcist 12y agoAbsolutely. SSH also sucks. TLS sucks badly. The only protocols that doesn't are those that haven't seen real-world usage yet. That's what drives innovation.
- EmanueleAina 12y ago> The fact that your DNS data is enumerable is an important change, for example. Indeed, but afaik there are methods to mitigate it (NSEC3) and more refined ones in development (NSEC4, NSEC5).