Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Handshake: Decentralizing DNS to Improve the Security of the Internet

namebase.io

Post reply on HN
Print view View original

21–30 of 86 posts

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#21

Post by troquerre »

w8rbt wrote: post #20
QuicksilverJohn wrote: post #17

Earlier quoted context omitted.

Basically, only the root record parsing is done in JS and then passed to unbound for resolution. Though it is possible to run a pure JS resolver, it's not really recommended. There's also a more portable authoritative & recursive [resolver in C]( https://github.com/handshake-org/hnsd ). Plus, the whole protocol for node communication and name resolution & proofs is so simple, that it's pretty easy to reimplement in a…

Right, thanks. And I hope my question does not sound too critical. I was just genuinely curious why JS was used. I think JS is fine for small to mid-sized tasks, prototyping and testing ideas. However, for real DNS servers, used by a lot of clients, I believe C, C++, Go or Rust would be an absolute requirement.

This is separate from the DNS resolver being written in JS, but the team behind Handshake also created bcoin, which is the only javascript fullnode (and non-core fullnode IIRC) that has mined a Bitcoin block.

https://github.com/bcoin-org/bcoin

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#22

Post by QuicksilverJohn »

hannob wrote: post #18

"Blockchain-based alternative to CAs" has been discussed before there even was the word blockchain (it was called sovereign keys, at least it's pretty close to a blockchain). I'd expect someone trying at least discussing why that didn't make it. Also I'm really annoyed by the "there was a problem with CAs in 2011, this system is really bad"-tune ignoring what has been changed since then. (E.g. the "You don’t know who…

It's actually pretty difficult to enumerate all trusted CAs (or even just what organizations are running CAs). Certificate Transparency certainly helps there, but it's not fully required, and doesn't solve all problems.

The DigiNotar attack (from 2011) was mainly chosen because it's well known and easy to convey. It wasn't even that technically effectively because Chrome had Google's keys pinned, so it was immediately blocked and reported (like you would get with CT today). But, only in Chrome.

More recent examples of mississuance, like tricking Comodo's OCR-based validation [0] or spoofing DNS to hijack Let's Encrypt issuance [1].

CA's are always going to be vulnerable to these sorts of attacks, and they have such a broad attack surface and so much systemic trust (i.e power) that can cause unbounded damages with any error.

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 [1] https://www.wired.com/2017/04/hackers-hijacked-banks-entire-...

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#23

Post by tynes »

w8rbt wrote: post #20
QuicksilverJohn wrote: post #17

Earlier quoted context omitted.

Basically, only the root record parsing is done in JS and then passed to unbound for resolution. Though it is possible to run a pure JS resolver, it's not really recommended. There's also a more portable authoritative & recursive [resolver in C]( https://github.com/handshake-org/hnsd ). Plus, the whole protocol for node communication and name resolution & proofs is so simple, that it's pretty easy to reimplement in a…

Right, thanks. And I hope my question does not sound too critical. I was just genuinely curious why JS was used. I think JS is fine for small to mid-sized tasks, prototyping and testing ideas. However, for real DNS servers, used by a lot of clients, I believe C, C++, Go or Rust would be an absolute requirement.

The JS implemention is a fork of bcoin, the JS Bitcoin full node and production backend.

It binds to libunbound but you are right that you would want a lower level language for it to be more scalable. There is a rust implemention work in progress here: https://github.com/UrkelLabs/rsd

There is also a C light client here: https://github.com/handshake-org/hnsd

For the consensus, there are C bindings for the cryptography and a workerpool that really speeds things up.

It could also be possible to dump the Handshake zone into a zone file and serve from behind unbound.

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#24

Post by troquerre »

hannob wrote: post #18

"Blockchain-based alternative to CAs" has been discussed before there even was the word blockchain (it was called sovereign keys, at least it's pretty close to a blockchain). I'd expect someone trying at least discussing why that didn't make it. Also I'm really annoyed by the "there was a problem with CAs in 2011, this system is really bad"-tune ignoring what has been changed since then. (E.g. the "You don’t know who…

Author of the post here. My aim was to keep this post focused and cover the differences between Handshake and previous blockchain DNS attempts in a separate post. The keyword here is attempts: previous projects like Namecoin and ENS haven't really taken off. I think the reason has to do with the underlying technology and the go-to-market strategy (or lack thereof) of the projects.

On the technology front, Handshake is the only naming blockchain that's launching with a light client that can resolve names. This may seem like a small thing but it's actually a critical input to success — without a light client, users would either need to run fullnodes (which no one does bc of the terrible ux) or rely on third party services. Third party services provide good ux but reduce the benefit of using the decentralized system in the first place.

On the go-to-market front, the initial distribution of names is really important. It's much more important than the initial distribution of something like Bitcoin because names are non-fungible. They're digital real estate so if a whale is able to bid up all the good names before adoption, there will be no incentive for new participants to invest in the ecosystem (this happened to the previous projects).

Handshake created a few GTM mechanics to prevent that outcome:

* The Alexa top 100k domains have been pre-registered, so that only those domain owners can register their names on Handshake

* Names are released for bidding over a 52 week period. If you hear about Handshake 8 months into launch there will still be a lot of good names available

* Auctions last two weeks and require locking up your coins, making it difficult to bid and win on a lot of names at once.

* Most importantly imo, Handshake coins are being distributed to developers, not investors. 70% of the initial Handshake coins are being airdropped to ~250k open-source developers. Basically, if you have a GitHub account with over 15 followers and an SSH key, you can anonymously claim Handshake coins. This is a no-strings attached giveaway so it will hopefully give developers a reason to check out the project, and it also makes it difficult for whales to buy up a lot of coins early on to outbid everyone.

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#25

Post by troquerre »

hlieberman wrote: post #19
troquerre wrote: post #16

Author of the post here. If you have any questions I'll be online for a while to respond to them. We're serious about attempting to improve the security of the internet, so criticisms are welcome too.

Isn't this just basically Namecoin but with venture capital money?

Previous attempts at blockchain naming have basically failed, and there are a few reasons why. I go more in-depth into why Handshake is different/may succeed this time around in my comment here: https://news.ycombinator.com/item?id=21001806

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#27

Post by ocdtrekkie »

troquerre wrote: post #12
Avamander wrote: post #6

Also posted on reddit with the owner trying to answer some questions: https://www.reddit.com/r/netsec/comments/d5iv4y/decentralizi...

Author of the post here. The r/netsec community brings up good points. One thing that's come up frequently is the question of trademark disputes. Handshake does have mechanisms in place to protect a good number of existing trademarks (only the domain owners of the top 100k Alexa domains can register their names as TLDs), and it also has mechanisms to prevent early squatting through the 52 week period for name rollout…

There are very good public safety reasons to allow lifting domains from their current owners. Like if someone owns Microsift and puts a phishing page on it.

What about botnet C2 servers?

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#29

Post by theli0nheart »

troquerre wrote: post #24
hannob wrote: post #18

"Blockchain-based alternative to CAs" has been discussed before there even was the word blockchain (it was called sovereign keys, at least it's pretty close to a blockchain). I'd expect someone trying at least discussing why that didn't make it. Also I'm really annoyed by the "there was a problem with CAs in 2011, this system is really bad"-tune ignoring what has been changed since then. (E.g. the "You don’t know who…

Author of the post here. My aim was to keep this post focused and cover the differences between Handshake and previous blockchain DNS attempts in a separate post. The keyword here is attempts: previous projects like Namecoin and ENS haven't really taken off. I think the reason has to do with the underlying technology and the go-to-market strategy (or lack thereof) of the projects. On the technology front, Handshake i…

I just tried to sign up but I got a message that namebase is in closed beta. How can I register?

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#30

Post by funfunfunction »

I love the idea but it seems like like a long shot to get the network effect working in your favor instead of against you. You mention a bottoms up approach and what happened in Catalonia but that is such a tiny percentage of the population facing problems that most people will hopefully never face. How does this go mainstream? Why should the average person care about a more secure solution to DNS? Most people happily ship their data off to Google and Facebook and are blissfully ignorant about the potential consequences. It seems like you would have to make people care more about internet privacy before something like this would work on a large scale.

IMO, it faces the problem that most crypto projects are running into; it might be good solution, but the problem doesn’t effect the average person enough for it gain mainstream traction.

Post reply on HN