Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

cloudflare.com

Post reply on HN
Print view View original

61–70 of 112 posts

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#61

Post by tptacek »

sarciszewski wrote: post #60
tptacek wrote: post #52

Earlier quoted context omitted.

Yes: assume one of the thousands of CAs you trust has been compromised by NSA.

Okay, so this is what happens: 1. Evil NSA compromises CA in BFE 2. Evil NSA subverts DNSSEC for COM to publish a bad CA certificate 3. Some combination of Google Certificate Transparency + HPKP discovers this, the CA in BFE gets removed from browsers If your point is "DNSSEC is pointless", OK. But it sounds like you're saying it makes us less secure. I'm just trying to figure out how that could even be.

I feel like I can't answer this without repeating this post:

http://sockpuppet.org/blog/2015/01/15/against-dnssec/

... or its FAQ.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#62

Post by throwaway2048 »

tptacek wrote: post #45
stephenr wrote: post #41

Earlier quoted context omitted.

Secure DNS allows a number of nice things that otherwise are a risk, such as trusting server SSH fingerprints without prompting on first use.

And to get that feature all you have to do is trust that the government that controls your TLD isn't going to fuck you. Because it's not like the USG would ever tamper with the DNS to further a policy goal, right? http://gizmodo.com/5936870/doj-seizes-domains-over-app-pirac...

even in the case of existing CA model+key pinning (at least before the key is pinned) you are still trusting the governments controlling the TLDs are not going to fuck you.

Id rather trust a handful of cctld nation states, than the nation states + everybody with access to a CA cert.

Also the idea that dnssec tld keys cannot be rotated is pure FUD, the root key signing keys themseves cannot, but they were extremely careful there.

If tampering is detected, do you really think TLD keys are going to be left alone, and not regenerated and the process extremely closely scrutinized?

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#63

Post by galois198 »

tptacek wrote: post #50
danyork wrote: post #48

Earlier quoted context omitted.

tptacek - the root keys will remain RSA-keyed for some time. The root Key Signing Key (KSK) is 2048-bit RSA. The root Zone Signing Keys (ZSKs) that are CHANGED every 3 months (a ZSK key ceremony is in fact happening TODAY ) are 1024-bit RSA. There was strong interest in changing the algorithm when the KSK is rolled (when that occurs is still to be decided), but for the moment an algorithm change will not be part of t…

How about, instead of getting started, we accept that DNSSEC is a failed 21-year-long experiment, and figure out a better way to get the moral equivalent of HSTS and HPKP for email links?

In the event that DNSSEC is adopted, what would the best course of action be to protect sites?

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#64

Post by peterwwillis »

Let's not lose sight of the fact that DNSSEC purports to make client connections more secure.

Does it?

- If the server in question doesn't have DNSSEC set up: No.

- If there is a problem with one of the pieces of DNS infrastructure between the server and client: No.

- If the DNS resolver server the client is using doesn't support DNSSEC: No.

- If the client's stub resolver isn't a validating one: No.

- The user is never notified if DNSSEC is working for them or not. They can only determine this by making queries with a command-line tool, or when they get a 'could not resolve domain' error on an invalidly-configured domain.

---

Compare this to HTTPS, where the only thing the client needs to verify a secure connection is:

- The server delivering its certificate and certificate chain to the client

- The client validates the certificates

- If it isn't validated the user knows immediately.

You can go ahead and implement DNSSEC for your server, but when it comes to HTTPS connections, this does not improve user security over what we have now.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#65

Post by drdaeman »

mtgx wrote: post #5

Why not DNSCurve? http://dnscurve.org I mean, I feel like adoption is so low for DNSSEC already - does it even matter if it's 0% for DNSCurve or 1% adoption for DNSSEC? Why even bother with a 20 year old protocol?

DNSSEC and DNSCurve are completely different matters.

As far as I understand (I may be wrong!):

1. DNSCurve establishes an encrypted and, optionally, authenticated channel between you and upstream nameserver. It doesn't do anything about the data that is served over that channel.

2. DNSSEC protects the integrity of the data that is served by authoritative nameserver (and redistributed further) from some rogue adversaries (except for registries).

About DNSCurve - you should ask your upstream nameserver provider (usually, an ISP) to support it. Although everyone running a nameserver should do so. But it's purpose is completely different from DNSSEC is about - even though the latter's concept is flawed.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#66

Post by caskance »

tptacek wrote: post #45
stephenr wrote: post #41

Earlier quoted context omitted.

Secure DNS allows a number of nice things that otherwise are a risk, such as trusting server SSH fingerprints without prompting on first use.

And to get that feature all you have to do is trust that the government that controls your TLD isn't going to fuck you. Because it's not like the USG would ever tamper with the DNS to further a policy goal, right? http://gizmodo.com/5936870/doj-seizes-domains-over-app-pirac...

That's the trust that government always requires. Being on the internet doesn't change the fact that the point of government is a monopoly on authorized use of force. They can always just send men with guns to your office, DNSSEC or no.

If you don't trust your government not to abuse their power, that's not a problem that Cloudflare can help you with.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#68

Post by fensipens »

gwu78 wrote: post #54

This is the fourth time in the last 30 days I have seen some blog post about DNSSEC on the front page. Three overtly pushing Cloudflare DNSSEC and one about email and DNSSEC written by a Cloudflare employee. But still no discussion of cache poisoning. So if a user runs their own personal cache bound to the loopback do they need DNSSEC? What if they run their own root? What if they have local copies of all the zones t…

> This is the fourth time in the last 30 days I have seen some blog post about DNSSEC on the front page. Three overtly pushing Cloudflare DNSSEC and one about email and DNSSEC written by a Cloudflare employee.

Absolutely, this is getting out of hand.

Would be easier to just buy HN and replace all top stories with your crappy DNSSEC ads..

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#69

Post by rajivm »

sarciszewski wrote: post #60
tptacek wrote: post #52

Earlier quoted context omitted.

Yes: assume one of the thousands of CAs you trust has been compromised by NSA.

Okay, so this is what happens: 1. Evil NSA compromises CA in BFE 2. Evil NSA subverts DNSSEC for COM to publish a bad CA certificate 3. Some combination of Google Certificate Transparency + HPKP discovers this, the CA in BFE gets removed from browsers If your point is "DNSSEC is pointless", OK. But it sounds like you're saying it makes us less secure. I'm just trying to figure out how that could even be.

I'm not sure why your question is being side-stepped, I also had the same wonder. It seems from reading though that the reason this is a problem is CAs are not involved at all in the DANE/TLS scenario. Instead, the X.509 cert. stored in DNS is trusted for TLS purposes simply because it is DNSSEC signed rather than CA issued. However, it seems at this time, no mainstream browser actually supports this natively (some have released plugins).

What I (and you) seem to have assumed was that this was DNS based certificate pinning, which to me would have made a lot of sense.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#70

Post by jessaustin »

tptacek wrote: post #57
aianus wrote: post #53

Earlier quoted context omitted.

> it can shitcan the CA, either evicting it from the trust store or placing onerous restrictions on it None of which prevents it from happening again with another one of the 300 CAs whenever another government gets antsy. > If the government-controlled super-CA that runs .COM misbehaves, we have no recourse. As a westerner I trust the super-CA that runs .COM 1000x more than some random CA in China or Iran or whatever…

One thing I love about DNSSEC threads is that I get to join the anti-NSA faction on HN. Unlike you, I do not trust the giant corporation that controls .COM under charter from the US Government. The USG has repeatedly abused its trust, often directly with respect to .COM. The Internet has not fled .COM. The idea that we would deploy a forklift upgrade of a core protocol, at immense expense (look at Cloudflare's own ma…

Once we deploy it, any notion of solving the problem correctly dies.

This seems to be the nut of the disagreement. Why do you expect that to be the case? Will good people like Marlinspike decide to just hang it up and throw in the towel now that CloudFlare have rolled out another service? Will CloudFlare themselves decide this is the last new security measure that anyone would ever want?

So far I have seen no technical reason why DNSSEC inhibits development of possibly more worthy security techniques. Sociological arguments are less convincing.

Post reply on HN