Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Use DNS TXT to share information

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 95 posts

Re: Show HN: Use DNS TXT to share information

#61

Post by tptacek »

mrweasel wrote: post #52
toast0 wrote: post #37

Earlier quoted context omitted.

clamav.net, like most domains, doesn't enable DNSSEC. Further, as designed, local resolvers don't validate DNSSEC, they just ask the recursive resolver to; a MITM between the local and the recursive can lie. So when wikipedia says DNSSEC can protect, that's the permissive can. Like things can happen. But don't rely on it.

Silly me for expecting an anti-virus company to care about security. The point remains: DNSSEC COULD make this safe to do.

The best-resourced, most widely respected security teams on the Internet tend strongly not to enable DNSSEC or advocate for its adoption, mostly because it doesn't solve meaningful problems.

Re: Show HN: Use DNS TXT to share information

#62

Post by tptacek »

fanf2 wrote: post #40
toast0 wrote: post #37

Earlier quoted context omitted.

clamav.net, like most domains, doesn't enable DNSSEC. Further, as designed, local resolvers don't validate DNSSEC, they just ask the recursive resolver to; a MITM between the local and the recursive can lie. So when wikipedia says DNSSEC can protect, that's the permissive can. Like things can happen. But don't rely on it.

No, stub resolvers are supposed to, and often do validate DNSSEC signatures. DNSSEC is designed so that validation should happen whenever any DNS data is received over the network.

That's the opposite of how DNSSEC works in practice.

Re: Show HN: Use DNS TXT to share information

#63

Post by whartung »

runjake wrote: post #36

It was pretty common for orgs to use TXT and HINFO (“host info”) records up through the 1990s. I still use them at work to provide hints and more information but the current fleet of IT workers don’t really grok anything beyond A and PTR. You’re just using DNS as intended. :-P

> the current fleet of IT workers don’t really grok anything beyond A and PTR.

Part of this, though is also who is "in control" of the server.

Most of the times, DNS is on the other side of the bastion, managed by Network Ops, and out of reach of Joe Developer. Perhaps a reasonable situation, fat finger DNS and Bad Things can happen. However, Joe Developer has carte blanche access to things like HTTP servers and with that they were allowed to go hog wild.

So, the innovation in the HTTP space exploded as it was a safer place to dabble to the point that every solution was viewed through the lens of HTTP.

In the end, devs don't know DNS because they don't need to know DNS, and even if they did, the Powers in NetOps weren't going to let them have their grubby fingers on it anyway.

Re: Show HN: Use DNS TXT to share information

#64

Post by tptacek »

egberts1 wrote: post #44
toast0 wrote: post #37

Earlier quoted context omitted.

clamav.net, like most domains, doesn't enable DNSSEC. Further, as designed, local resolvers don't validate DNSSEC, they just ask the recursive resolver to; a MITM between the local and the recursive can lie. So when wikipedia says DNSSEC can protect, that's the permissive can. Like things can happen. But don't rely on it.

Wrong (EDIT: oops, I am wrong) current.cvd.clamav.net is (EDIT:) NOT currently DNSSEC-signed. Just that their dnsquery() via freshclam daemon is not using val_res_query() when pulling in the version number, so it is unverified DNS querying going on … over there.

There's no DS record for clamav.net at all. They're not signed.

Re: Show HN: Use DNS TXT to share information

#65

Post by gunapologist99 »

philipwhiuk wrote: post #54
RajT88 wrote: post #31

Timely. I've been noticing on flights that the in-flight wifi uses a squid proxy to block you until you pay - but most of the time, you'll get whatever data from the DNS Forwarder even if you haven't paid yet. I've been noodling on how to build a simple proxy off DNS to test on my next flight.

This sort of escape is how Kaminsky ended up as the guy who broke DNS. (From the opener to https://www.wired.com/2008/11/ff-kaminsky/ )

RIP Dan Kaminsky

Re: Show HN: Use DNS TXT to share information

#66

Post by gunapologist99 »

You could also securely hash a username and password together with something like argon2ID, and then authenticate users by seeing if the base64'ed TXT record exists. No need to hit an overloaded database, just dig and you'll even have the benefits of local caching with per-record TTL's!

But should you do crazy things like this? Absolutely not!

DNS is notoriously prone to MITM, injection, cache poisoning, DoS, etc. DANE and DNSSEC are horrible bodges that don't actually do anything useful or in a secure way.

Even though it's the foundation of almost everything we try to do securely, including the basis for TLS DV certificate (totally fungible, regardless of a hundred or so certificate authorities, including many located in authoritarian regimes!) validation:

DNS is absolutely and irredeemably broken forever, from a security perspective, and can never be fixed. As tempting (and easy) as it is to hack on it or treat it as an ultra-fast and extensible UDP remotely-accessible lookup database, just don't. (It just needs to die in a fire, probably along with SMTP.)

Unfortunately, even if someone came up with some system that could credibly replace it, that system would inevitably have a LOT of privacy and censorship trade-offs, so DNS is what we're stuck with.

Just stay very aware of the risks of encoding anything security-related inside DNS and try to minimize your reliance on it as best you can.

Re: Show HN: Use DNS TXT to share information

#67

Post by runjake »

whartung wrote: post #63
runjake wrote: post #36

It was pretty common for orgs to use TXT and HINFO (“host info”) records up through the 1990s. I still use them at work to provide hints and more information but the current fleet of IT workers don’t really grok anything beyond A and PTR. You’re just using DNS as intended. :-P

> the current fleet of IT workers don’t really grok anything beyond A and PTR. Part of this, though is also who is "in control" of the server. Most of the times, DNS is on the other side of the bastion, managed by Network Ops, and out of reach of Joe Developer. Perhaps a reasonable situation, fat finger DNS and Bad Things can happen. However, Joe Developer has carte blanche access to things like HTTP servers and with…

Yep. I was speaking from a netops/sysadmin standpoint.

My belief is that TXT and HINFO saw declining use within an org as Microsoft Windows DNS Server usage grew[1][2][3].

1. Windows DNS Server hides those records behind a sub-menu item.

2. Windows DNS Server attracted noobs (a good thing, I suppose). Heck, these days, we give low/middle-tier IT workers DNS server access (via DnsAdmins group), which is crazy in my mind, but nonetheless common.

3. Crusty, old admins were better at typing yy in vi and changing the record type when creating new records in BIND (old DNS software).

Re: Show HN: Use DNS TXT to share information

#68

Post by AtNightWeCode »

hashstring wrote: post #59
donselaar wrote: post #58

Earlier quoted context omitted.

Makes sense indeed. It exists and it's called DANE. https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

Yes and then your government controls your “trusted” connection.

Like NSA did not controlled CA:s? Or are you one of those conspiracy nuts that think NSA cracked it?

Re: Show HN: Use DNS TXT to share information

#69

Post by blechinger »

gunapologist99 wrote: post #66

You could also securely hash a username and password together with something like argon2ID, and then authenticate users by seeing if the base64'ed TXT record exists. No need to hit an overloaded database, just dig and you'll even have the benefits of local caching with per-record TTL's! But should you do crazy things like this? Absolutely not! DNS is notoriously prone to MITM, injection, cache poisoning, DoS, etc. DA…

I agree with the idea that one should not trust DNS with any information one does not want public. I'm not totally convinced DNS is irreparably broken though. What are your thoughts on DNS over HTTPS?

Re: Show HN: Use DNS TXT to share information

#70

Post by devrand »

mrweasel wrote: post #52
toast0 wrote: post #37

Earlier quoted context omitted.

clamav.net, like most domains, doesn't enable DNSSEC. Further, as designed, local resolvers don't validate DNSSEC, they just ask the recursive resolver to; a MITM between the local and the recursive can lie. So when wikipedia says DNSSEC can protect, that's the permissive can. Like things can happen. But don't rely on it.

Silly me for expecting an anti-virus company to care about security. The point remains: DNSSEC COULD make this safe to do.

It would still be prone to DoS though. The request is unencrypted so a MITM could just not respond to those requests. This would effectively block clients from being able to update/get new definitions.
Post reply on HN