Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

cloudflare.com

Post reply on HN
Print view View original

31–40 of 112 posts

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#31

Post by drzaiusapelord »

caskance wrote: post #25
tptacek wrote: post #24

I think it's important that those of you who haven't read up on DNSSEC understand how bad an idea it is: https://news.ycombinator.com/item?id=10539418 If DNSSEC had been deployed a few years back, Muammar Gadaffi could conceivably controlled BIT.LY's TLS keys. Yesterday, today, and tomorrow, DNSSEC gives the NSA immense control over the TLS keys of sites in .COM, .ORG, .NET, .CO.UK, .IO, .COM.AU, and many more.

That's what it means to have a domain in Libya - you're subject to the jurisdiction of the officially recognized Libyan government. If you don't want to have to deal with the whims of a crazy dictator, don't register your business in his country.

and exactly what country is safe from the whims of politics? I was just reading about censorship in the Netherlands and other Euro states because of fear of offending religious people, especially muslims. If the far left Europeans can't protect speech, then who can? DNNSEC just enables centralized government control on a level that's not needed. DNS is fine as-is. Domain authentication should be done via the transport layer like SSL. That's the way things are going now anyway.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#32

Post by nailer »

jnbiche wrote: post #26
sintaxi wrote: post #3

Does this seem ironic to anyone else considering CloudFlares SSL offering essentially is a MITM attack?

Is an SSL-terminating load balancer an MITM attack?

I think the parent is referring to CloudFlare not requiring SSL between CloudFlare and their customers.

An SSL-terminating load balancer is in plaintext between the LB and your servers, whereas CloudFlare Universal SSL can be plaintext over the internet.

Since the latter still shows users it's a secure connection, it would be reasonable for CF to require HTTPS between themselves and their customers. Last time I asked CF about this, their answer was "yes, but not our problem".

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#33

Post by tptacek »

danyork wrote: post #27

It's great to see this microsite (and the announcement yesterday) as this rollout by CloudFlare will do two major things to help move DNSSEC forward: 1. Simplify the process of setting up DNSSEC-signing for so many people; and 2. Advance the usage of stronger crypto through the used of ECDSA (DNSSEC algorithm 13). The first point will help with getting many more domains signed. The second point will help those of us…

1. The roots and TLDs remain RSA-keyed.

2. As recently as months ago, those keys were 1024-bit RSA.

3. If the zones above those Cloudflare manages are RSA, it doesn't matter if Cloudflare's own zones are ECDSA.

4. ECDSA is itself outmoded and dangerous.[1]. Cloudflare has the first significant deployment of curve-based DNS on the Internet, and because of standards group torpor, they're forced to use bad NIST-curve DSA, while the rest of the world has moved on to better curves and deterministic signatures.

5. It takes just a few hours to write a new draft for ED25519. Pretty much the entire browser vendor community agrees that TLS needs a standardized Curve25519; a draft for that was submitted over a year ago, and still hasn't made it out of committee because of bikeshedding. Worse: browsers can enable Curve25519 piecemeal, because TLS is a negotiation protocol. DNS isn't. Because DNSSEC advocates have pushed deployment of broken '90s crypto, it could take close to a decade to get Ed25519 deployable in DNSSEC.

The idea that better DNSSEC crypto is just a standards document away is a pretty good illustration of what has gone wrong with 21+ years of attempted DNSSEC standardization.

There's a better alternative than DNSSEC, and it isn't DNSCurve: it is literally "do nothing". Don't break the Internet. Don't create a massive new deployment of embarrassing old curve crypto. Don't effectively sign keys over to the NSA. Billions of dollars of commerce flow over the Internet every week and none of it, not one bit, is protected by DNS security. DNSSEC isn't useful, it isn't needed, it certainly isn't a priority. It's in this case a way for Cloudflare to make some extra money, and nothing more.

[1]: http://blog.cr.yp.to/20140323-ecdsa.html

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#34

Post by aianus »

tptacek wrote: post #24

I think it's important that those of you who haven't read up on DNSSEC understand how bad an idea it is: https://news.ycombinator.com/item?id=10539418 If DNSSEC had been deployed a few years back, Muammar Gadaffi could conceivably controlled BIT.LY's TLS keys. Yesterday, today, and tomorrow, DNSSEC gives the NSA immense control over the TLS keys of sites in .COM, .ORG, .NET, .CO.UK, .IO, .COM.AU, and many more.

Still sounds like an improvement over the current PKI where any CA can sign any cert for any domain.

How many roots do you have in your browser's trust store? How many of them would roll over and mis-issue certs if presented with a secret warrant in their country of residence? (All of them.)

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#35

Post by meowface »

sintaxi wrote: post #3

Does this seem ironic to anyone else considering CloudFlares SSL offering essentially is a MITM attack?

They allow "SSL termination" where traffic to/from Cloudflare's Edge is protected with TLS, as well as full TLS, where you also provide your own certificate and the entire chain is protected.e.

So, you can very easily opt out of the "MITM" if you buy your own certificate. You can use a self-signed one to get a little more safety within Cloudflare's network, or a CA-signed one for a lot more safety.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#36

Post by blantonl »

jacquesm wrote: post #22
[deleted] wrote: post #6

[deleted]

If you don't know for sure that that is a post by a cloudflare employee then I suggest you change the text or delete the comment. When google rolls out a new feature there are 10's of submissions around the theme and surely not all of those are by google employees, why should cloudflare be any different?

Exactly. And why should it matter anyways who posted the article here on HN? The community here decides what is or is not worthy of discussion, not any single company.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#37

Post by tptacek »

aianus wrote: post #34
tptacek wrote: post #24

I think it's important that those of you who haven't read up on DNSSEC understand how bad an idea it is: https://news.ycombinator.com/item?id=10539418 If DNSSEC had been deployed a few years back, Muammar Gadaffi could conceivably controlled BIT.LY's TLS keys. Yesterday, today, and tomorrow, DNSSEC gives the NSA immense control over the TLS keys of sites in .COM, .ORG, .NET, .CO.UK, .IO, .COM.AU, and many more.

Still sounds like an improvement over the current PKI where any CA can sign any cert for any domain. How many roots do you have in your browser's trust store? How many of them would roll over and mis-issue certs if presented with a secret warrant in their country of residence? (All of them.)

No. See:

https://www.imperialviolet.org/2015/01/17/notdane.html

There are 3873497 CAs your browser has to trust today. DANE adds a 3873498th and a 3873499th, and the ones it adds are controlled by NSA.

The solution to the CA problem is to drastically reduce the power CAs have, which is what is happening with key pinning and certificate transparency and whatever follows that.

The solution to the CA problem can't possibly be "create a new super-CA controlled by governments".

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#38

Post by sarciszewski »

tptacek wrote: post #24

I think it's important that those of you who haven't read up on DNSSEC understand how bad an idea it is: https://news.ycombinator.com/item?id=10539418 If DNSSEC had been deployed a few years back, Muammar Gadaffi could conceivably controlled BIT.LY's TLS keys. Yesterday, today, and tomorrow, DNSSEC gives the NSA immense control over the TLS keys of sites in .COM, .ORG, .NET, .CO.UK, .IO, .COM.AU, and many more.

How does DNSSEC give immense control over TLS keys to sites in those TLDs exactly? I think I'm missing something.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#39

Post by tptacek »

sarciszewski wrote: post #38
tptacek wrote: post #24

I think it's important that those of you who haven't read up on DNSSEC understand how bad an idea it is: https://news.ycombinator.com/item?id=10539418 If DNSSEC had been deployed a few years back, Muammar Gadaffi could conceivably controlled BIT.LY's TLS keys. Yesterday, today, and tomorrow, DNSSEC gives the NSA immense control over the TLS keys of sites in .COM, .ORG, .NET, .CO.UK, .IO, .COM.AU, and many more.

How does DNSSEC give immense control over TLS keys to sites in those TLDs exactly? I think I'm missing something.

The motivating use case for DNSSEC is DANE. DANE stores TLS certificates in DNSSEC-signed DNS records. But the top of the DNSSEC tree is --- de jure! --- controlled by governments.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#40

Post by [deleted] »

tptacek wrote: post #24

I think it's important that those of you who haven't read up on DNSSEC understand how bad an idea it is: https://news.ycombinator.com/item?id=10539418 If DNSSEC had been deployed a few years back, Muammar Gadaffi could conceivably controlled BIT.LY's TLS keys. Yesterday, today, and tomorrow, DNSSEC gives the NSA immense control over the TLS keys of sites in .COM, .ORG, .NET, .CO.UK, .IO, .COM.AU, and many more.

[deleted]
Post reply on HN