wizeman

43 ms·

301.
by wizeman 4y ago
> No mainstream operating system does that today ... by default. Doesn't mean that the software doesn't support it (by simply flipping DNSSEC=no to DNSSEC=yes in resolved.conf). It also doesn't mean they can't switch
302.
by wizeman 4y ago
If you wanted something like certificate transparency for a DNS PKI, you wouldn't want an exact copy of WebPKI's CT system as it exists right now. That wouldn't work, obviously! That's not the point at all. In fact, a ce
303.
by wizeman 4y ago
> You cannot implement a CT-like system on top of DNS. [citation needed] > It only works in the WebPKI because browsers are able to force CAs to participate, by distrusting CAs that don't include SCTs in their signed certificates
304.
by wizeman 4y ago
> Currently Verisign can't sell certs directly, and would be caught by a CT log/report if they hijacked DNS to do this. And then what? Like you said, browsers can't remove Verisign for abuse of trust, because Verisign isn&
305.
by wizeman 4y ago
First of all that doesn't matter, because people trust what DNS does regardless of whether it claims to be secure or not. I've never seen anyone or any software distrust a DNS response unless they already know what it was supposed
306.
by wizeman 4y ago
Apparently systemd-resolved, which I think is the DNS resolver used on most modern Linux distros, defaults to DNSSEC=allow-downgrade, which means it will validate DNSSEC if it's working, and disable validation otherwise. Supposedly thi
307.
by wizeman 4y ago
> Not with any attitude: what you and the phone sysadmins propose is, effectively, to eliminate all shared DNS caching from the Internet. A beautiful dream! But that's all it is. No, a local caching resolver (with or without DNSSEC
308.
by wizeman 4y ago
> for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help Sorry but I don't follow. The 99.9% of people that do not know what DNS is, don&#x
309.
by wizeman 4y ago
> Giving more power to a too-big-too-fail monopolist and hoping it will behave well is not a sensible system. It's not more power, it's the same power it already has! This too-big-to-fail monopolist you're talking about ca
310.
by wizeman 4y ago
> This is ISPs hijacking DNS for their customers, which DNSSEC doesn't prevent It does if you run a local caching resolver with DNSSEC validation which is what I mentioned in the post you replied to. This caching resolver works as y
311.
by wizeman 4y ago
> All DNSSEC gives you is a false sense of security as you merrily validate signatures on spoofed records because they're generated by the same people who own the DS record responses. As opposed to the current system, which also giv
312.
by wizeman 4y ago
If your attacker is .COM then you already lost, with or without DNSSEC, with or without the current CA PKI system.
313.
by wizeman 4y ago
... which only works for browsers. What about all the other uses of certificates? TLS itself is used for securing almost every network communication that goes over the Internet nowadays, including SMTP (and even DNS with DNS-over-TLS or DoH
314.
by wizeman 4y ago
> The point is you don't build a system that assumes DNS is trustworthy, because it isn't. But the current CA PKI system already assumes DNS is trustworthy, even much more than if you were using DNSSEC-protected DNS PKI system,
315.
by wizeman 4y ago
Do you mean, like all the DNS hijacking attacks listed here, occurring every single day for millions of users spanning multiple countries and including all the consumer ISPs in Indonesia, for example? https://en.wikipedia.org&#x2
316.
by wizeman 4y ago
Sorry, thread limit achieved. For tptacek: > Not with any attitude: what you and the phone sysadmins propose is, effectively, to eliminate all shared DNS caching from the Internet. A beautiful dream! But that's all it is. No, a loca
317.
by wizeman 4y ago
I'm not saying it exists right now, I'm saying it could be created for a DNS PKI system if it was found to be necessary (like you seem to be implying)?
318.
by wizeman 4y ago
There's no reason why you couldn't use certificate transparency with DNS PKI? Why do you seem to always be talking like if DNSSEC is incompatible with other security technologies? DNSSEC isn't incompatible with DoH either, bu
319.
by wizeman 4y ago
> the page you're citing talks (1) about stub-to-cache DNS lookups that DNSSEC doesn't protect at all, but DoH does Both DNSSEC and DoH can protect against DNS hijacking. DNSSEC can give you end-to-end protection if you use a D
320.
by wizeman 4y ago
> And you're missing the fact that CAs that misissue certificates can and will be distrusted by Chrome and Mozilla That doesn't protect against attacks from occurring, it only protects against future attacks from the same peopl
321.
by wizeman 4y ago
> What does it matter if the client knows or doesn't know the whole chain from the resolver to all its peers? There's nothing the client can do about it. If the client expected all the links to be secured (which is what you pro
322.
by wizeman 4y ago
What do you mean, more dependence? How does DANE make a domain more dependent on the TLD owners than they already are? Specifically, what kind of attack would a TLD owner be able to perform on a domain that uses DANE that they wouldn&#x27
323.
by wizeman 4y ago
> (a) Bottom-up DNS security can continue to succeed to the point where it links resolvers and caches to authority servers Even if that would happen, the client would have no way to know if all the links were indeed secured. And even it
324.
Amazing Marvin: Customizable Task Manager and Daily Planner(amazingmarvin.com)
1 points by wizeman 4y ago|0 comments
325.
by wizeman 4y ago
Just a word of caution: I've tried replacing the mitigation patch (which I had been using for 18 months) with the author's minimal fix (the first out of the 6 patches, which is supposed to fix the issue) and I've immediately
326.
by wizeman 5y ago
> it's entirely possible to make a GUI based like a SUSE configurator based on nix There is such a project already: https://github.com/nix-gui/nix-gui
327.
by wizeman 5y ago
> Is it more secure? Doesn’t seem like it. Why not? Unless all 9 "insecure" sources are 100% attacker-controlled or broken at the same time, they would still be adding entropy. Each additional source is adding one more hoop for
328.
by wizeman 5y ago
From that description It sounds like the Orbs are inherently trusted components of the system, i.e. if you can get your hands on one (and their cryptographic certificates), or even remotely access one (through some vulnerability) then you c
329.
by wizeman 5y ago
I love lobste.rs too, an invite would also be appreciated!
330.
by wizeman 5y ago
As far as I understand, the Mercury compiler doesn't do compile-time garbage collection (see the LIMITATIONS file).

More ›