Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Handshake: Decentralizing DNS to Improve the Security of the Internet

namebase.io

Post reply on HN
Print view View original

71–80 of 86 posts

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#71

Post by KomradeKeeks »

tialaramex wrote: post #70
lucideer wrote: post #63

Earlier quoted context omitted.

I'm not seeing any explanation behind any of your attestations. Are they assumptions? Saying conflicts are inevitable/unavoidable between name systems seems simplistic: it's a problem to solve. Not necessarily easy, but I know of no hard law making it implicitly insurmountable. Why does changing name system destroy all value? Sure, changing any system is disruptive and can be relatively destructive; such changes must…

The conflict is intuitively obvious. A name system maps names _to_ something. If system A and system B have the same mapping, that's just the same system under a different name. If they have different mappings they conflict because the mapping will give me different results from system A versus system B. It's that fundamental.

The address bar in Chrome shows both the string as a potential search, and URLs in recent history/tabs with that string. Why wouldn't a Handshake-supporting browser do something similar?

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#72

Post by PakG1 »

tuxxy wrote: post #58
donavanm wrote: post #54

Earlier quoted context omitted.

Its just one example of the entire governance problem thats conspicuously absent from the post. How is dispute resolution handled? Identity verification? Attestation? Reasonable answers to those questions are generally counter to the raison d’etre of setups like this. And without it you have a spam and scam goldrush to squat the most “valuable” entries and pretty big gap in _human_ trust in the system.

What inherently requires an identity to register a domain name?

When you become big, famous, influential, anything like that. Then people can register your domains and misrepresent you or just use your namesake as a platform to attack you (write bad things about you at best, do some really nasty damage at worst). Need to play defense preemptively.

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#73

Post by EGreg »

tynes wrote: post #41
EGreg wrote: post #32

But how does this solve the problem of Trust on First Use? Blockchains can safeguard the integrity of the data, but how do we know that painting in the real world corresponds to the token that purports to represent it? How do we know that business on Google really is that business and not a guy in their basement? How does Google or anyone really verify it, whether they are a top-down corporation or a blockchain or a…

Proof of Work solves that by preventing Sybil attacks - it's costly to mine (which is equivalent to signing off on, because it wouldn't make sense to sign an invalid block, you would get rewarded). It's the only signature scheme known to be dynamic and allow for an arbitrary participant size. The point is that you can trust the chain with the most proof of work. As long as you maintain a diverse set of peers and vali…

It doesn’t solve this problem at all. The site says:

How do you know that Google's public key is actually Google's public key? When you make that first request to Google, an intermediate network may have intercepted your request and returned a fake public key for Google. CAs attempt to solve this problem. CAs are trusted third parties that verify the authenticity of public keys for websites.

How does proof of work ensure that google.com really goes to Google and not someone who paid $2,000 to mine something?

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#74

Post by vectorEQ »

topranks wrote: post #49
vectorEQ wrote: post #45

isn't dns already decentralised? (apart form everyone basically using the same server(s) / google ?) you can just set up your own dns if you want to have your own mappings of ip->dn and vice versa. just set your dns to the server you prefer?

The root DNS servers are distributed widely and operated by different organizations. But it’s a single root, and it is administered by ICANN directly who decide who can be a root name operator. So there is central control there.

this does not stop one from having their own dns server and resolving what they like. the protocol itself has no owner, just a specified way of functioning. one can choose what dns server to use, and how to configure that to respond.

building some sort of overlay network on top of the internet has been done before (.onion anyone?).

How would this improve upon such a scheme for example? I really don't think it adds anything but the word 'blockchain' to the equation, and i honestly don't think that adds anything in the way of security.

additionally, to revoke ones domain name to say, resolve to another host, changing hosting provider for example, would seem impossible in an immutable blockchain. Would that result in forks or in namespace pollution?

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#75

Post by troquerre »

EGreg wrote: post #73
tynes wrote: post #41

Earlier quoted context omitted.

Proof of Work solves that by preventing Sybil attacks - it's costly to mine (which is equivalent to signing off on, because it wouldn't make sense to sign an invalid block, you would get rewarded). It's the only signature scheme known to be dynamic and allow for an arbitrary participant size. The point is that you can trust the chain with the most proof of work. As long as you maintain a diverse set of peers and vali…

It doesn’t solve this problem at all. The site says: How do you know that Google's public key is actually Google's public key? When you make that first request to Google, an intermediate network may have intercepted your request and returned a fake public key for Google. CAs attempt to solve this problem. CAs are trusted third parties that verify the authenticity of public keys for websites. How does proof of work en…

A miner wouldn’t be able to do that. Only the private key owner of Google could do that. At most a miner could do a double spend attack (would cost a lot more than $2000), but that wouldn’t change the DNS record for Google.

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#76

Post by EGreg »

troquerre wrote: post #75
EGreg wrote: post #73

Earlier quoted context omitted.

It doesn’t solve this problem at all. The site says: How do you know that Google's public key is actually Google's public key? When you make that first request to Google, an intermediate network may have intercepted your request and returned a fake public key for Google. CAs attempt to solve this problem. CAs are trusted third parties that verify the authenticity of public keys for websites. How does proof of work en…

A miner wouldn’t be able to do that. Only the private key owner of Google could do that. At most a miner could do a double spend attack (would cost a lot more than $2000), but that wouldn’t change the DNS record for Google.

The question is how do you know that the owner of the private key is the “owner of GOOGLE”. That’s what CA’s solve. Blockchain doesn’t solve this problem.

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#77

Post by lone_haxx0r »

PakG1 wrote: post #72
tuxxy wrote: post #58

Earlier quoted context omitted.

What inherently requires an identity to register a domain name?

When you become big, famous, influential, anything like that. Then people can register your domains and misrepresent you or just use your namesake as a platform to attack you (write bad things about you at best, do some really nasty damage at worst). Need to play defense preemptively.

I prefer technology to deal with the technical issues and individuals to deal with their individual issues.

Tech can't possibly cater to everyone's special needs.

I'm totally fine with domain names being the interface between thr protocol and the human user. All other mappings (e.g. legal names) fall in the realm of human politics.

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#78

Post by nikolay »

Sorry! I'd rather trust Mozilla than some craptocurrency/bullchain company trying to make money out of everything. I don't want to be dealing with speculators and people after the get-rich-quick scheme masqueraded as a "change everything and solve all your problems" solution!

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#79

Post by digitalhans »

nikolay wrote: post #78

Sorry! I'd rather trust Mozilla than some craptocurrency/bullchain company trying to make money out of everything. I don't want to be dealing with speculators and people after the get-rich-quick scheme masqueraded as a "change everything and solve all your problems" solution!

https://www.debian.org/News/2019/20190329

https://news.softpedia.com/news/gnome-and-gimp-receive-400k-... https://www.gnome.org/news/2018/08/gnome-foundation-receives... https://www.fsf.org/news/free-software-foundation-receives-1...

Re: Handshake: Decentralizing DNS to Improve the Security of the Internet

#80

Post by comex »

tialaramex wrote: post #55
comex wrote: post #43

It still seems bizarre to me that this system lets people register arbitrary TLDs. If nothing else, sooner or later a new ICANN gTLD will conflict with a Handshake registration. At that point, Handshake will no longer be a backwards compatible extension of the existing DNS, so systems will have to choose one or the other. Maybe the Handshake authors think that when that day comes (and it's probably not that far off),…

> I want to support decentralized name systems This isn't a coherent thought, which illustrates why they fail. A name _system_ is something you have exactly _one_ of, because otherwise they conflict. To support more than one is to give up altogether, it might actually be slightly worse than just not caring at all. So you'd need to pick one and then, even if clearly better alternatives are subsequently proposed, you _…

Most alternative domain name systems nest everything under a single TLD – .eth, .onion, etc. In theory, either the standard DNS or a different alternative name system could cause a conflict by using the same TLD themselves. But unsurprisingly, ICANN/IETF are a lot more receptive to "please avoid using this one semi-branded TLD" than "please hand over the entire namespace to us". .onion is already formally reserved by IETF RFC as a "special-use domain name", and hopefully .eth will join it in the future. As for a different alternative name system, conflict over .eth could theoretically happen if Ethereum forks again or if ENS itself is somehow forked, but an independent effort would presumably pick a different name.
Post reply on HN