41–50 of 104 posts
Source link: https://www.fireeye.com/blog/threat-research/2019/01/global-...
[1] https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS...
[2] https://www.fireeye.com/blog/threat-research/2019/01/global-...
Earlier quoted context omitted.
after reading the headline I immediately thought of "14 DNS Nerds Don't Control the Internet" [0]. [0] https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con...
Much better than (CA0 || CA1 || ... ). All it takes is one CA out of 10s of independent CAs to misbehave to insecure whole tls. In DNSSEC/DANE, world only has to watch one entity rather than 10s of entities.
Earlier quoted context omitted.
Much better than (CA0 || CA1 || ... ). All it takes is one CA out of 10s of independent CAs to misbehave to insecure whole tls. In DNSSEC/DANE, world only has to watch one entity rather than 10s of entities.
Except if that one entity misbehaves, even if you catch them, you can't do anything about it, because they own the TLD.
Still you have 3 choices in DNSSEC/DANE,
- get a .xxx, trust dnsroot.
- get a .xxx (when .xxx is as easy to register as xxx.com), trust dnsroot.
- pick one tld out 1000s and get xxx.ttt, and trust ttt and dnsroot.Earlier quoted context omitted.
Your completely right, where on Earth would criminals and scammers be able to get a credit card? /s I am having a hard time understanding how more websites using https could possibly be a worse thing.
Yeah, yeah. So many on HN has this mindset. Criminals just whip up credit cards like it's nothing. They don't. It's noisy to use some grandma's credit card to buy a cert for buttsnstuff.ca when she donates to her local church five times a month. Almost all criminals are fucking dumb or even if they're smart they fuck up before they're good and land themselves in jail. Like at least 98% of them. HTTPS is a tire fire.…
Earlier quoted context omitted.
after reading the headline I immediately thought of "14 DNS Nerds Don't Control the Internet" [0]. [0] https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con...
Much better than (CA0 || CA1 || ... ). All it takes is one CA out of 10s of independent CAs to misbehave to insecure whole tls. In DNSSEC/DANE, world only has to watch one entity rather than 10s of entities.
Earlier quoted context omitted.
It doesn't matter if you use offline signing for your zone if someone owns up the account you log into to control your domain with your registrar , or owns up the registrar . So no, even with offline signing, DNSSEC did nothing here. But it's worth keeping in mind that most organizations can't use offline signing, because the duct-tape-and-baling-wire solutions DNSSEC applies to people dumping zones with NSEC records…
Depending on the registrar, updating glue records can be a separate process that requires additional authentication. Not long ago my registrar required me to contact them directly to update glue records. Offline signing is a very useful feature precisely because it makes it easier to differentiate security domains. For example, I could use offline signing for foo.com (along with a registrar lock) but delegate the sub…
(You addressed the first half of my comment and not the second).
If I had the time or inclination, I’d write a transparent https gateway that used let’s encrypt to man-in-the-middle http and https connections to servers behind it.
You could imagine deploying something like that on the edge of AWS for mass surveillance purposes, or maybe a misguided white-hat could use it to “secure” http-only services (it’s an improvement in a defeatist sort of way...)
Earlier quoted context omitted.
Yeah, but it is a problem with domain-validated certificates in general that kinda defeats the purpose of SSL. It seems most of the time that a web site is "hacked" (defaced) somebody changed the DNS instead of attacking the actual web server. SSL signing can potentially be a second line of defense, but only if having control of the DNS (thus web and email) is insufficient to get a cert.
What are the alternatives? About 20 years ago, I remember having to go through tons of hoops to get a certificate. Faxing corporate docs and other bureaucracy. That can all be forged.
- CNAME record: pointless if your DNS is hacked
- Put a file or add a meta-tag to HTML at a specific path: pointless if your DNS is hacked, they can just add/change A/AAAA record and host their own webserver
- Email to webmaster@.. etc: pointless if your DNS is hacked, add MX record
Earlier quoted context omitted.
Except if that one entity misbehaves, even if you catch them, you can't do anything about it, because they own the TLD.
You have to trust somone under DNS. The only trustless naming system I can think of is over a PoWChain (eg example.btc). Still you have 3 choices in DNSSEC/DANE, - get a .xxx, trust dnsroot. - get a .xxx (when .xxx is as easy to register as xxx.com), trust dnsroot. - pick one tld out 1000s and get xxx.ttt, and trust ttt and dnsroot.
Earlier quoted context omitted.
Much better than (CA0 || CA1 || ... ). All it takes is one CA out of 10s of independent CAs to misbehave to insecure whole tls. In DNSSEC/DANE, world only has to watch one entity rather than 10s of entities.
No. You have to trust all the CAs , and the governments that control the DNS. https://www.imperialviolet.org/2015/01/17/notdane.html
Not in DNSSEC. .xxx need only trust dnsroot. yyy.xxx need only trust .yyy and dnsroot.
firefox/chrome/etc with support from important orgs with high value names (google.com/bankofamerica.com/etc) would then make sure that dnsroot/.com/etc do not abuse the trust. They have incentive and methods of punishment. There is no legal authority that clients need to map DNS . to existing root keys. A client can map a.b.c to any key it wants.
The risk of gov overreach is same for both tls and DNSSEC. DNSSEC just trusts fewer entities. The only people who benefit from current system, are CAs who are getting $$$ for nothing.
> https://www.imperialviolet.org/2015/01/17/notdane.html
This is orthogonal. Weak Keys are not required or implied characterstic of DNSSEC.