Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

cloudflare.com

Post reply on HN
Print view View original

81–90 of 112 posts

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#81

Post by deftnerd »

jgrahamc wrote: post #72
jedisct1 wrote: post #67

Earlier quoted context omitted.

Are you serious about that?

We're interested in making the Internet more secure. Go look at our history. Why would we not be thinking about ways to secure DNS etc. further?

Well said!

I know one thing I would like is Cloudflare doing something magical with Sub Resource Integrity.

Maybe if the source HTML specifies a SRI string, check that the hash in the HTML matches the hash of the resource before allowing it in your cache for that website. If it doesn't match, don't cache that resource and don't serve it.

This would allow sites to enable and enforce SRI without browser support.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#82

Post by jessaustin »

tptacek wrote: post #77
jessaustin wrote: post #70

Earlier quoted context omitted.

Once we deploy it, any notion of solving the problem correctly dies. This seems to be the nut of the disagreement. Why do you expect that to be the case? Will good people like Marlinspike decide to just hang it up and throw in the towel now that CloudFlare have rolled out another service? Will CloudFlare themselves decide this is the last new security measure that anyone would ever want? So far I have seen no technic…

I don't know. Why don't you ask Moxie Marlinspike, who frequently comments on HN, what he thinks of DNSSEC?

His comments are noted. They don't seem to include, "we're shutting down Convergence and Tack now that CloudFlare have rolled out DNSSEC."

Can you cite a technical reason why DNSSEC inhibits development of possibly more worthy security techniques?

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#83

Post by tptacek »

jessaustin wrote: post #82
tptacek wrote: post #77

Earlier quoted context omitted.

I don't know. Why don't you ask Moxie Marlinspike, who frequently comments on HN, what he thinks of DNSSEC?

His comments are noted. They don't seem to include, "we're shutting down Convergence and Tack now that CloudFlare have rolled out DNSSEC." Can you cite a technical reason why DNSSEC inhibits development of possibly more worthy security techniques?

That's not really my argument.

DNSSEC will kill any meaningful future work in DNS security, but like I keep saying, I'm not anti-DNSSEC because I'm pro-DNSCurve; I just think DNS security is a stupid problem. Draw a layer diagram of TCP/IP up through HTTPS. Somewhere on that diagram you have to draw a line and say "below this line we're not going to attempt cryptographic security". That's not a new insight; it's basically the core argument of Saltzer-Reed-Clark, the foundational design paper for the Internet.

I tried to keep my issues with DNSSEC terse and clean here:

http://sockpuppet.org/blog/2015/01/15/against-dnssec/

They are:

* It doesn't solve an important problem.

* It does create a new government-controlled PKI, which some people will depend on, to the detriment of safety and privacy.

* It's a cryptographically weak protocol designed by 90s-non-cryptographers.

* It breaks applications, as 'peterwwillis has been pointing out here for days.

* It's so expensive to deploy that Cloudflare is the biggest news to happen to it in 21 years.

* It doesn't protect browser lookups.

* It doesn't encrypt DNS requests and, in fact, actually forces sites to reveal more about their hosts than normal DNS does.

* Like I said up top, it's architecturally incoherent in a way that the End to End paper actually used as its motivating example all the way back in 1981.

I have spent a lot of time over the past 10 years arguing with people about DNSSEC. I'm not just making random stuff up in HN threads about this. You're probably not going to "gotcha" me on any of this.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#84

Post by takeda »

tptacek wrote: post #24

I think it's important that those of you who haven't read up on DNSSEC understand how bad an idea it is: https://news.ycombinator.com/item?id=10539418 If DNSSEC had been deployed a few years back, Muammar Gadaffi could conceivably controlled BIT.LY's TLS keys. Yesterday, today, and tomorrow, DNSSEC gives the NSA immense control over the TLS keys of sites in .COM, .ORG, .NET, .CO.UK, .IO, .COM.AU, and many more.

How is that worse? You already have US government in your CAs, for example Federal Common Policy CA. At least with DNSSEC only the organization that owns the TLD can issue certificates. With CA system in the browsers a country you might never heard of can issue certificate for google.com (which already happened).

Yes, the danger could be root certificate is managed by a single organization, but this can be easily solved in software of DNS server (for example ignore root and store certificate for every TLD, or implement policy to trust it only for certain TLDs). I would not be surprised if that's already implemented.

Now with ICAAN move (which I personally am not a big fan of) there are TLDs that are owned by private organizations, so it is possible to have entire chain without any government being involved in it.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#85

Post by caskance »

tptacek wrote: post #79
caskance wrote: post #66

Earlier quoted context omitted.

That's the trust that government always requires. Being on the internet doesn't change the fact that the point of government is a monopoly on authorized use of force. They can always just send men with guns to your office, DNSSEC or no. If you don't trust your government not to abuse their power, that's not a problem that Cloudflare can help you with.

We're required to trust them for the DNS today. We aren't required to trust them for TLS keys. But DNSSEC/DANE formally and irrevocably gives them that authority.

They already have the ability. Since that can't be revoked, might as well make it transparent and grant them the authority to match it.

It's certainly better than the current CA system.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#86

Post by hueving »

caskance wrote: post #66
tptacek wrote: post #45

Earlier quoted context omitted.

And to get that feature all you have to do is trust that the government that controls your TLD isn't going to fuck you. Because it's not like the USG would ever tamper with the DNS to further a policy goal, right? http://gizmodo.com/5936870/doj-seizes-domains-over-app-pirac...

That's the trust that government always requires. Being on the internet doesn't change the fact that the point of government is a monopoly on authorized use of force. They can always just send men with guns to your office, DNSSEC or no. If you don't trust your government not to abuse their power, that's not a problem that Cloudflare can help you with.

So you're excuse is that it's insecure but only to the government and you should be okay with systems insecure to the government? That's a sad state affairs if that's where the security community is.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#87

Post by hueving »

takeda wrote: post #84
tptacek wrote: post #24

I think it's important that those of you who haven't read up on DNSSEC understand how bad an idea it is: https://news.ycombinator.com/item?id=10539418 If DNSSEC had been deployed a few years back, Muammar Gadaffi could conceivably controlled BIT.LY's TLS keys. Yesterday, today, and tomorrow, DNSSEC gives the NSA immense control over the TLS keys of sites in .COM, .ORG, .NET, .CO.UK, .IO, .COM.AU, and many more.

How is that worse? You already have US government in your CAs, for example Federal Common Policy CA. At least with DNSSEC only the organization that owns the TLD can issue certificates. With CA system in the browsers a country you might never heard of can issue certificate for google.com (which already happened). Yes, the danger could be root certificate is managed by a single organization, but this can be easily sol…

You don't have to trust the government CAs. A specific CA isn't part of SSL protocol.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#88

Post by tptacek »

caskance wrote: post #85
tptacek wrote: post #79

Earlier quoted context omitted.

We're required to trust them for the DNS today. We aren't required to trust them for TLS keys. But DNSSEC/DANE formally and irrevocably gives them that authority.

They already have the ability. Since that can't be revoked, might as well make it transparent and grant them the authority to match it. It's certainly better than the current CA system.

I know a lot of people seem to think that, but that's just not right.

You can pin a certificate with X.509 CA TLS, and you can theoretically pin a certificate against DNSSEC/DANE (no browser does and it's unlikely they ever will; browsers flirted with DNSSEC a few years ago and that code has been withdrawn).

But when you pin an X.509 CA cert, you can also punish CAs that issue fraudulent CAs that break pins. This has already happened several times.

When you break a DNSSEC/DANE pin, you have no recourse. Everyone relies on the same .COM keys.

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#89

Post by hueving »

throwaway2048 wrote: post #56
tptacek wrote: post #44

Earlier quoted context omitted.

No. (a) is wrong. The difference between DNSSEC's government-controlled super CA and a normal TLS CA is that when Google spots a normal TLS CA misbehaving because of an alert from a broken pin or CT log, it can shitcan the CA, either evicting it from the trust store or placing onerous restrictions on it. Both of these things have happened and will keep happening. Google cannot do that to .COM or .IO. If the governmen…

reposting a comment: What do you think would happen under a DNSSEC-DANE TLS world if that started being detected via key pinning/CT ? There is just no way the NSA is going to risk it except in very very specific circumstances they can easily control, (exactly the same situation as HPKP) because, they too will be forever burned just like an ssl CA would, except now they cant just switch to one of hundreds of other CAs…

And how exactly do you think rotating a TLD key will help if it's obvious that TLD will just give the new key to the NSA anyway?

Re: Cloudflare Introduces Universal DNSSEC: Secure DNS for Your Domain

#90

Post by tptacek »

hueving wrote: post #86
caskance wrote: post #66

Earlier quoted context omitted.

That's the trust that government always requires. Being on the internet doesn't change the fact that the point of government is a monopoly on authorized use of force. They can always just send men with guns to your office, DNSSEC or no. If you don't trust your government not to abuse their power, that's not a problem that Cloudflare can help you with.

So you're excuse is that it's insecure but only to the government and you should be okay with systems insecure to the government? That's a sad state affairs if that's where the security community is.

It's not. The "security community" does not generally support DNSSEC. Most people in the security community don't think about DNSSEC, or DNS security, at all.

DNSSEC is being driven by three forces today:

1. The IETF, which has been working on it for 21+ years and has for the last 10 expressed continuing and increasing frustration that they can't just get the damn thing deployed.

2. The US Government, which is mandating its deployment in some circumstances.

3. CDN services like Cloudflare, who are interested in an Internet where standing up a server presence involves technology so complicated that almost nobody will DIY it. See: what happened with SMTP mail.

Post reply on HN