Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC KSK rollover breaks DNS resolution for .nz domains

status.internetnz.nz

Post reply on HN
Print view View original

31–40 of 181 posts

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#31

Post by cmeacham98 »

tptacek wrote: post #26
cmeacham98 wrote: post #24

Earlier quoted context omitted.

The most devastating and primary attack I am worried about is someone obtaining a TLS certificate for my domain via services like Let's Encrypt. Thus, I really care about LE getting the right IP, I don't care about random users' DNS getting hijacked because their browser will reject the missing/invalid certificate.

LetEncrypt does validate DNSSEC signatures (when they exist), but CA's aren't even required to do that. LetsEncrypt also does multi-perspective lookups, so a single hijacked DNS transaction or poisoned cache is insufficient to trick it. Hopefully, at some point in the not-too-distant future, LE's multi-perspective lookup will generate data we can look at about the frequency of DNS attacks on certificate issuance. I e…

I'll take this massive shift of the goalposts as agreement that DNSSEC is much closer to solving some problems today than DoH is.

I would appreciate it if you would update your other comments in this thread clarifying that, as we both now agree they are incorrect.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#32

Post by hsbauauvhabzb »

In 2020 I scraped fortune top 500 companies for dnssec and found iirc one domain using dnssec.

It certainly feels like the wrong way of solving problems (ramming more into the domain registry always seems like a bad option). Is the technology dead or destined to fail?

Edit: rationale: dnssec solves domain validity, but https tls solves almost the same problem but has better backing (azure said they don’t support dnssec and recommended tls as a better alternative). Dnssec also does not solve bgp hijacking, which combined with ip based tls signing servers moots any value dnssec has - sure you could registrar lock your domain via dns (preventing letsencrypt signing things), but if a threat actor has the capability to bgp hijack to perform such an attack and is targeting you, you probably have bigger issues elsewhere.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#33

Post by teddyh »

cyberax wrote: post #15

DNSSEC designers screwed up by making rollovers to be atomic. Instead, they should have allowed the responses to be signed by two keys. And a way to specify as a hint which key should be used, so that the zone owner could gather feedback on the rollover safety.

No, DNSSEC does allow for multiple signatures. You can use tools like dnsviz.net to see which key is valid from upstream (if you don’t know how to do it manually).

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#35

Post by belorn »

tptacek wrote: post #8
gg-plz wrote: post #4

Earlier quoted context omitted.

if your browser ignored all certificate errors, I guess you'd call that a feature?

If your browser ignored all certificate errors, you'd have a real security problem. That's not at all the case for DNSSEC: it's possible that all of the DNSSEC root keys could hit Pastebin and nobody would really need to be paged.

Browsers did ignore most certificate errors back in the early 2000s. HTTPS sites were fairly rare and most people did not care about it or even considered https to be a negative. Many administrators considered it as bad technology that only increased instability with no obvious benefit. "Who cares about what people post to a forum?" was something I personally heard when I added https to one site. It was only really banks with plain passwords that needed https, and then external hardware devices really made https obsolete for that problem.

For more fun diving into this topic, I can recommend a famous old presentation called the "Everything you Never Wanted to Know about PKI but were Forced to find out", and godzilla crypto tutorial written by the same author (Peter gutmann). The certificates in browsers has had a long history of problems and ill designs. People did not like them, and they definitively did not like them when they caused major issues.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#36

Post by teddyh »

hsbauauvhabzb wrote: post #32

In 2020 I scraped fortune top 500 companies for dnssec and found iirc one domain using dnssec. It certainly feels like the wrong way of solving problems (ramming more into the domain registry always seems like a bad option). Is the technology dead or destined to fail? Edit: rationale: dnssec solves domain validity, but https tls solves almost the same problem but has better backing (azure said they don’t support dnss…

When criticizing DNSSEC, you can’t assume that the system for TLS certificates – i.e. CAs – is perfect. They both have their weak points and drawbacks.

Both BGP and certificate issuance have bootstrapping problems, which are handled today by imperfect TOFU-like solutions. DNSSEC is, IMHO, perfectly positioned to solve both of those problems. I.e. use certificates all you like, but verify them by looking up the TLSA record in the DNS using DNSSEC. No need to trust CAs. BGP could possibly use the same solution, using the reverse lookup .arpa DNS space.

DNSSEC is the building block from which secure certificates and BGP routes can be built, without the ad-hoc CA system we have today.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#38

Post by tptacek »

belorn wrote: post #30
tptacek wrote: post #25

Earlier quoted context omitted.

Seems simple: we should abandon these particular car door locks, but not necessarily the concept of car door locks altogether.

If we follow this analogy further, why should we keep the concept of car doors if particular car locks can be made with bugs in them? Doesn't the possibility of bugs in locks means that there will always be a risk, even if we abandon specific locks that has demonstrated to have a bug in them?

We should keep the locks that work and don't cause other problems, and ditch the other ones. Again, seems simple.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#39

Post by bawolff »

hsbauauvhabzb wrote: post #32

In 2020 I scraped fortune top 500 companies for dnssec and found iirc one domain using dnssec. It certainly feels like the wrong way of solving problems (ramming more into the domain registry always seems like a bad option). Is the technology dead or destined to fail? Edit: rationale: dnssec solves domain validity, but https tls solves almost the same problem but has better backing (azure said they don’t support dnss…

> Dnssec also does not solve bgp hijacking

This seems like a pretty unreasonable complaint. Dnssec also doesn't stop phishing. Or nukes.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#40

Post by plugin-baby »

bombcar wrote: post #29
belorn wrote: post #23

Earlier quoted context omitted.

Some car automatically lock their doors during driving in order to prevent hijackings, especially at red lights. Same cars has issues with drivers being locked inside if the car goes into the water. That is a bug. Is the solution to abandon locks on cars, or is the solution to fix the problem of the car doors staying locked when submerged into water? The security system by now is fairly advanced and addressing issues…

Locked doors can help prevent the door from flying open in an accident, too.

And maybe make rescue more difficult after a crash?
Post reply on HN