iscoelho

8 ms·

61.
by iscoelho 1y ago
I am focusing on DNS because this thread is about DNSSEC. The topic of doing it in to the TLS servers themselves is a tangent not relevant to this thread.
62.
by iscoelho 1y ago
How about another incident in 2022? Attackers BGP hijacked a dependency hosting a JS file, generated a rogue TLS certificate, and stole $2 million. Keep in mind: these are incidents we know about, not including incidents that went undetecte
63.
by iscoelho 1y ago
Yes but it is still possible to execute BGP hijacks that capture 100% of traffic, rendering multi-perspective validation useless. RPKI sadly only solves naive "accidental" BGP hijacks, not malicious BGP hijacks. That's a diff
64.
by iscoelho 1y ago
> and they just impersonate the server after the DNS step? Yes, there are different mitigations to prevent BGP hijacking the webserver itself. Preventing a rogue TLS certificate from being issued is the most important factor. CAA DNS rec
65.
by iscoelho 1y ago
> I'm sorry, this is just such an incredibly fine-tuned threat model for me to take it seriously. You claim it is fine-tuned, but it has happened in the real world. It is actually even better for attackers that it is "obscure&q
66.
by iscoelho 1y ago
Yessir, that isn't possible yet but it would absolutely be a solution! I'd love to see it.
67.
by iscoelho 1y ago
I would love to go to back to the drawing board and solve the security pitfalls in BGP & DNS. I wish the organizations and committees involved did a better job back then. Sadly, we live in this reality for now, so we do what we can with
68.
by iscoelho 1y ago
DNSSEC is about authentication & integrity. DNSCRYPT/DOH is about privacy. They solve completely different problems and have nothing to do with one another. There is also no reason we can't have both.
69.
by iscoelho 1y ago
That’s false. Any organization that enables DNSSEC for their domains gains its security benefits and prevents any potential DNS hijacking. At this point, your statements border on intentional dishonesty. Please be more truthful and responsi
70.
by iscoelho 1y ago
I hope the facts speak for themselves.
71.
by iscoelho 1y ago
Happy to see security audits doing good work.
72.
by iscoelho 1y ago
Yes TLS SNI is ubiquitous. I am referring specifically to TLS SNI metadata collection.
73.
by iscoelho 1y ago
DoH does not solve anything that DNSSEC solves. They have almost no overlap.
74.
by iscoelho 1y ago
and Slack.com still uses DNSSEC. They appear to not have come to the same conclusion.
75.
by iscoelho 1y ago
Not saying they are malicious actors, but easy answer would be any Public WiFi anywhere. They all intercept DNS, less than 1% intercept SNI. It is also public knowledge that certain ISPs (including Xfinity) sniff and log all DNS queries, ev
76.
by iscoelho 1y ago
"at absolutely enormous expense" Citation? A BGP hijack can be done for less than $100. "You can't just name call your way to getting this protocol adopted" I do not care if you adopt this protocol. I care that you
77.
by iscoelho 1y ago
I never said "most". I said it happens and is documented.
78.
by iscoelho 1y ago
"Most domains". Yes, it is possible that nobody bothers to DNS hijack your domains. Sadly I've worked for organizations where it did happen, and now they have DNSSEC.
79.
by iscoelho 1y ago
You are again ignoring the fact that DNSSEC would have prevented a $152,000 hack. Yes, we are aware organizations are not always serious about security. For those that are though, DNSSEC is a helpful tool.
80.
by iscoelho 1y ago
"I do like that the threat model you propose is coherent only for sites behind Cloudflare, though." The threat model I proposed is coherent for Cloudflare because they have done a lot of engineering to make it almost impossible to
81.
by iscoelho 1y ago
Yeah I'm by no means saying the implementation is good. RPKI is a joke as well in my opinion. But it's all we have right now. I am saying it is dishonest to discount the real security threat of not having DNSSEC.
82.
by iscoelho 1y ago
TLS doesn't provide any security in this case because TLS certificates are generated based on DNS. See Lets Encrypt.
83.
by iscoelho 1y ago
There are 2 ways to pull off this attack: 1. Hijack the HTTP/HTTPS server. For some IP ranges, this is completely infeasible. For example, hijacking a CloudFlare HTTP/HTTPS range would be almost impossible theoretically based on t
84.
by iscoelho 1y ago
As you should be aware, multi-perspective validation does not solve anything if your BGP hijack is accepted to be global. You will receive 100% of the traffic. DNSSEC does greatly assist with this issue: It would have prevented the cited in
85.
by iscoelho 1y ago
I would say it is more a testament to the unfortunate state of cybersecurity. These "theoretical" attacks happen. Everyone just thinks it won't be them.
86.
by iscoelho 1y ago
It is important. This is unfortunate rhetoric that is harming the safety of the internet. "For instance, in April 2018, a Russian provider announced a number of IP prefixes (groups of IP addresses) that actually belong to Route53 Amazo
87.
by iscoelho 2y ago
I agree with this post that Hetzner is a bad example. They are focused on a budget deployment. I do not agree that a state-of-the-art high capacity deployment is as expensive as you think it is. If an organization pays MSRP on everything, h
88.
by iscoelho 2y ago
In Ashburn, VA, I can buy Dark Fiber for $750 MRC to any datacenter in the same city. I can buy Dark Fiber for $3-5K MRC to any random building in the same city. That Duplex Dark Fiber with DWDM can run 4TBPS of capacity at 100GE (40x 100GE
89.
by iscoelho 2y ago
It's a great start, but it's missing the silent killer: data transfer! AWS egress data transfer pricing is 100-1000x the price of equivalent IP Transit. (Yes, I am not exaggerating.) It is so significant that I've seen data t
90.
by iscoelho 2y ago
Exactly! When your savings are 2-3x per unit, you have more room in the budget to over-provision. Now you have increased headroom for growth, and improved redundancy.

More ›