Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is your internet up to date?

en.conn.internet.nl

Post reply on HN
Print view View original

51–60 of 78 posts

Re: Is your internet up to date?

#51

Post by ak217 »

hannob wrote: post #4

Wow, this is terribly misleading DNSSEC propaganda. It tells me: "Protected from redirection to false IP addresses (DNSSEC)" What does that mean? It means that whatever other DNS server I use seems to verify DNSSEC signatures (I use Google's DNS fwiw). Yet this doesn't provide any reasonable sense of protection, as the connection to that DNS server may very well be compromised. This would very well show DNSSEC protec…

OK, so for those of us naive about DNS security, can someone summarize the current best practice for DNS on gateway routers and roaming endpoints (laptops)?

I know Google has supported an HTTPS bridge for DNS for a while (https://developers.google.com/speed/public-dns/docs/dns-over...) but I'm not aware of any router firmware or Mac/Windows/Linux software that supports it, is it out there?

Re: Is your internet up to date?

#52

Post by tptacek »

ak217 wrote: post #51
hannob wrote: post #4

Wow, this is terribly misleading DNSSEC propaganda. It tells me: "Protected from redirection to false IP addresses (DNSSEC)" What does that mean? It means that whatever other DNS server I use seems to verify DNSSEC signatures (I use Google's DNS fwiw). Yet this doesn't provide any reasonable sense of protection, as the connection to that DNS server may very well be compromised. This would very well show DNSSEC protec…

OK, so for those of us naive about DNS security, can someone summarize the current best practice for DNS on gateway routers and roaming endpoints (laptops)? I know Google has supported an HTTPS bridge for DNS for a while ( https://developers.google.com/speed/public-dns/docs/dns-over... ) but I'm not aware of any router firmware or Mac/Windows/Linux software that supports it, is it out there?

The short answer is: pretty much everyone uses normal DNS, because the many show-stopping problems with DNSSEC includes the insane design decision not to protect the "last mile" between the stub resolver on your own machine and the "DNS server" (technically: recursive cache) that DHCP configures.

If you're using Google's DNS, it will (pretty much pointlessly) validate DNSSEC records for you --- but the link between your computer and Google's DNS servers are completely unprotected (any attacker could simply trick your browser into believing there was no such thing as DNSSEC).

This doesn't much matter because only a tiny, tiny fraction of all DNS records are DNSSEC-signed. The modal experience for companies that do take the trouble to sign their DNS records is "taken offline completely by DNSSEC configuration mistakes". There is virtually no upside to participating.

The good news about all of this is that there's really nothing you need to do to have good DNS OPSEC. Just do what everyone else does, including pretty much all security people: delegate security to a higher layer of the Internet stack.

Re: Is your internet up to date?

#53

Post by tptacek »

pornel wrote: post #13
minxomat wrote: post #6

Earlier quoted context omitted.

The question for many residential internet users is: Just because I set my DNS to Google's, do my request really arrive there? Or does my ISP use transparent DNS proxies? I know that for many ISPs around here (Telekom especially), setting your DNS doesn't have any effect unless you run a local resolver (or DNScrypt). More info and how to test if you are affected by this: https://news.ycombinator.com/item?id=13037858

Just because you've securely looked up an IP address, do your packets really arrive there? That's why DNSSEC without DANE seems pointless (and with DANE/TLS seems redundant).

I can't tell if you're saying TLS is pointless with DANE, or DNSSEC is pointless with some combination of DANE+TLS.

DANE isn't severable from DNSSEC; it relies on the DNSSEC PKI to function. Unfortunately, that PKI is absolutely the worst part of DNSSEC.

Re: Is your internet up to date?

#54

Post by tptacek »

danyork wrote: post #48
pjc50 wrote: post #8

Earlier quoted context omitted.

I thought DNSSEC was supposed to be verifiable by the client ? If it isn't then it's pointless in the way that you suggest, but I find it hard to believe that hole was left.

You also could run your own DNS resolver on your local device and do the DNSSEC validation there. One example of this bundled up in a way that is easy to install is DNSSEC-Trigger: https://nlnetlabs.nl/projects/dnssec-trigger/ More info in this blog post from Red Hat: http://developerblog.redhat.com/2015/04/14/writing-an-applic...

Only if your ISP doesn't molest DNS packets. More importantly: this only works for a small set of nerds; it doesn't scale to every user on the Internet --- this is the worst kind of "insecurity for thee not me". For refusing to make compromises like this, and instead insisting that sound cryptography be made available to all users, Moxie and Trevor just won the Levchin Prize at RWC.

Notice also that Signal provides a massive amount of cryptographic security to billions of people without needing a PKI controlled at its roots by world governments.

Re: Is your internet up to date?

#55

Post by brb3 »

ubertaco wrote: post #50
qubitcoder wrote: post #49

Earlier quoted context omitted.

For what it's worth, I'm getting 1,000Mbps with AT&T Fiber for $75 a month. I'm located just an hour northwest of Atlanta, in Rome, Georgia.

Over in Cherokee County, meanwhile, it's $70/mo with Comcast for 75Mbps. I was hopeful for a Google Fiber rollout when they announced it, but no dice.

I'm paying $100/mo for gigabit fiber through Ringgold Telephone Company. I'm in Ringgold, GA (right on the Tennessee border, south of Chattanooga).

Re: Is your internet up to date?

#56

Post by pikzen »

tedmiston wrote: post #46
alexdumitru wrote: post #36

Earlier quoted context omitted.

Come to Romania. We have IPv6, 1Gbps for just ~6 pounds. And as a bonus I got two 3G SIM cards + usb modems with unlimited traffic entirely free. http://www.speedtest.net/result/5951144497.png

How do you have it so fast and so cheap? This is far better than what most of us have in the US by the way.

Romania (and if my memory serves me right, a lot of eastern european countries) have heavily invested into their internet infrastructure. Huge costs for their government, but it is paying off. As a result, almost the entire country has high speed links for dirt cheap.

It's somewhat similar throughout Europe too. Speeds may vary. Prices are relatively low. Paying 29€/month for whatever your line is able to supply is common in France. Regrettably, due to our choice of investing into copper lines heavily, our infrastructure is starting to get old. For example, I am getting 8Mbps/1Mbps and it's not likely to change soon.

Re: Is your internet up to date?

#57

Post by phicoh »

ak217 wrote: post #51
hannob wrote: post #4

Wow, this is terribly misleading DNSSEC propaganda. It tells me: "Protected from redirection to false IP addresses (DNSSEC)" What does that mean? It means that whatever other DNS server I use seems to verify DNSSEC signatures (I use Google's DNS fwiw). Yet this doesn't provide any reasonable sense of protection, as the connection to that DNS server may very well be compromised. This would very well show DNSSEC protec…

OK, so for those of us naive about DNS security, can someone summarize the current best practice for DNS on gateway routers and roaming endpoints (laptops)? I know Google has supported an HTTPS bridge for DNS for a while ( https://developers.google.com/speed/public-dns/docs/dns-over... ) but I'm not aware of any router firmware or Mac/Windows/Linux software that supports it, is it out there?

Google of course wants people to continue to use their DNS resolvers. So it is in their interest to focus only on techniques to improve access to their resolvers.

One thing that happened in recent years is that a very nice library called 'getdns' has been developed. Getdns does local DNSSEC validation but also contains various ways of accessing DNS servers and resolvers ("Roadblock Avoidance")

I use getdns in ssh for SSHFP, to obtain SSH key fingerprints from DNS. If DNSSEC doesn't work then SSH fails (or complains about an insecure connection). So far my experience is that is works.

The problem with DNSSEC local validation is that it doesn't protect your privacy.

So there are two techniques under development to address that. One is to run DNS directly over TLS. The second is to run DNS over HTTPS.

Running DNS over TLS has to advantage that the semantics are clear (just DNS over TCP but then encrypted) but the downside that the port may be blocked.

DNS over HTTPS is unlikely to get blocked, but there are too many ways to transmit DNS over HTTPS, so it may take some time for that to get sorted out.

Of course, moving DNS from a lightweight UDP exchange to TLS or HTTPS requires quite a bit more resources on the server side.

So, local DNSSEC validation works. It is just matter of turning it on. Server side, if the admins are behind a DNSSEC validating resolver then they quickly figure how to avoid breaking it.

When it comes to privacy, if you send all your DNS queries to Google, who else do you care about who might be watching your DNS traffic?

Re: Is your internet up to date?

#58

Post by ak217 »

tptacek wrote: post #52
ak217 wrote: post #51

Earlier quoted context omitted.

OK, so for those of us naive about DNS security, can someone summarize the current best practice for DNS on gateway routers and roaming endpoints (laptops)? I know Google has supported an HTTPS bridge for DNS for a while ( https://developers.google.com/speed/public-dns/docs/dns-over... ) but I'm not aware of any router firmware or Mac/Windows/Linux software that supports it, is it out there?

The short answer is: pretty much everyone uses normal DNS, because the many show-stopping problems with DNSSEC includes the insane design decision not to protect the "last mile" between the stub resolver on your own machine and the "DNS server" (technically: recursive cache) that DHCP configures. If you're using Google's DNS, it will (pretty much pointlessly) validate DNSSEC records for you --- but the link between y…

What about https://dnscrypt.org/?

Re: Is your internet up to date?

#59

Post by deathanatos »

eumoria wrote: post #38
alexdumitru wrote: post #36

Earlier quoted context omitted.

Come to Romania. We have IPv6, 1Gbps for just ~6 pounds. And as a bonus I got two 3G SIM cards + usb modems with unlimited traffic entirely free. http://www.speedtest.net/result/5951144497.png

O.o I'm in New York City which for America has pretty decent fiber service and 100mbit costs ~61 pounds ($75). Very jealous!

I'm in Silicon Valley, and outside of SF (where the ISP market isn't a monopoly), a gigabit from Comcast costs ~$300/mo. It still seems absurd to me that I'm 20 minutes from companies like Apple and Google, but getting decent ≥100Mbps Internet is expensive and challenging.

(I pay for "business class" however, so my bill is slightly more expensive per Mbps because of that (the $300/mo above is residential, though). But I get an almost nearly static IPv4 address, and customer support that's only moderately bad, as opposed to the residential level support which beyond bad.)

Re: Is your internet up to date?

#60

Post by Magnets »

wrboyce wrote: post #3
alicewales wrote: post #2

> Is Your Internet Up-To-date? Of course it isn't. I live in the UK.

Mine is, and I live in the UK also. I'm not sure what joke you're making. Sure, we may not have the best bandwidth (although at my previous house I had 250MBit), but supporting IPv6 (etc) has nothing to do with being in the UK. Find a decent ISP, I recommend Zen (or if you can afford them, AA).

It's good if you have FTTC, it's very patchy if you don't
Post reply on HN