Universal DNSSEC: Secure DNS for Every Domain

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @09:39AM (#10539517)

DNSCrypt, which is far better and less costly than DNSSEC and does not cede to the US Government control over TLS keys, was proposed and deployed by a Cloudflare competitor. So, no.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by FiloSottile on Tuesday November 10, 2015 @10:08AM (#10539710)

> and does not cede to the US Government control over TLS keys

Hold on. This is actively conflating DNSSEC and DANE.

I know your point that the "main feature" of DNSSEC is enabling DANE, and I respect that. But the two domains are still distinct: DNS security and the PKI built on top of that.

DNSCrypt only addresses DNS security, so it should be compared to pure DNSSEC, which obviously does not "cede to the US Government control over TLS keys".

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @10:10AM (#10539717)

I don't agree with you. The top-down PKI DNSSEC expresses is inextricable from the DNS lookup security it attempts to provide. That DNSCrypt does a better job of solving lookup security without resorting to a government-controlled PKI is germane.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @10:10AM (#10539715)

Filo: How do you feel about pushing for enabling DNSCrypt on your DNS servers, and working with the folks at Mozilla to make sure Firefox supports it? ;)

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by jgrahamc on Tuesday November 10, 2015 @10:23AM (#10539824)

was proposed and deployed by a Cloudflare competitor. So, no.

Bad reasoning. You think we'll not deploy HTTP/2 because the head of the committee works for Akamai? Cmon.

DNSCrypt needs a secure resolver and client software. CloudFlare doesn't have either of those things which rather hampers us deploying DNSCrypt.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @10:28AM (#10539866)

> CloudFlare doesn't have either of those things which rather hampers us deploying DNSCrypt.

Behold:

* https://dnscrypt.org/

* https://github.com/bitbeans/SimpleDnsCrypt

I'm sure with Filo on your team you could make that happen.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by jamespo on Tuesday November 10, 2015 @12:21PM (#10540684)

How are cloudflare going to distribute this proxy to end users?

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @04:24PM (#10542610)

I don't understand your question. I'm asking if they can consider supporting it and help browser vendors (i.e. Firefox) support the client side of DNSCrypt.

What does CloudFlare have to distribute?

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @11:27AM (#10540242)

Can you at least give me credit for not saying "EXTRA! EXTRA! INTERNET'S LARGEST DDOS PROTECTION SERVICE SUPPORTS DEPLOYMENT OF INTERNET'S WORST DDOS AMPLIFIER"? :)

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by jgrahamc on Wednesday November 11, 2015 @06:08AM (#10545999)

Just this once.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by dsl on Tuesday November 10, 2015 @12:58PM (#10541003)

OpenDNS will happily send you queries over DNSCrypt. Thats like 3-4% of the internet right there.

They also open sourced client implementations for end boxes to talk to them or any other recursive securely.

jedisct1 is also looking for work right now, he'd happily implement it all for you I'm sure.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by _jomo on Tuesday November 10, 2015 @10:24AM (#10539829)

AFAIK DNSCrypt (as the name suggests) encrypts transfer of DNS data between client & server whereas DNSSEC authenticates (to some level) the validity of DNS data, but does not encrypt it.

How do both compare ("far better")?

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by akerro on Tuesday November 10, 2015 @11:28AM (#10540253)

DNSCrypt is to secure your connection client-server and server-client.

DNSSEC is for server-server, to propagate existing addressbook.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @11:32AM (#10540292)

That's not entirely true. DNSCrypt also aims for end-to-end security. The real difference is that DNSSEC is a top-down protocol that doesn't work until every link between your browser and the DNS roots agree, and DNSCrypt is a bottom-up protocol that provides value even if just a few people use it.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by FullyFunctional on Tuesday November 10, 2015 @12:24PM (#10540705)

It's far from the only difference, but it worth calling out:

  Only DNSCrypt protects your privacy!

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by fweespeech on Tuesday November 10, 2015 @09:41AM (#10539526)

Which competitor?

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @09:42AM (#10539540)

OpenDNS: https://www.opendns.com/about/innovations/dnscrypt/

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by eastdakota on Tuesday November 10, 2015 @12:32PM (#10540776)

OpenDNS isn't a competitor in any way. They provide recursive DNS, not authoritative DNS. CloudFlare provides authoritative DNS, not recursive. Simplistically: Their customers are web surfers, ours are websites. We've partnered with them on multiple initiatives, supported their technical work, and I consider David Ulevitch, their founder and CEO, a personal friend.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by rdl on Tuesday November 10, 2015 @12:15PM (#10540643)

We are basically friends with OpenDNS. Complementary products, not competitors. Now that they are owned by Cisco, there is some competition (on premise network hardware vs. what CloudFlare offers), but that wouldn't prevent us from using a good open source tool they develop.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by fweespeech on Tuesday November 10, 2015 @10:03AM (#10539672)

As far as I'm aware, OpenDNS doesn't provide CDN-esque security services and is purely a DNS provider?

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by jamespo on Tuesday November 10, 2015 @10:20AM (#10539808)

Oracle don't produce a browser but still compete with Google and Microsoft in other areas

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by fweespeech on Tuesday November 10, 2015 @10:39AM (#10539943)

Yeah, but unless its something like Incapsula that functions as a direct replacement ... its not really competitive with Cloudflare's value proposition.

You don't use Cloudflare as a DNS provider. Their value proposition [imho] is as a CDN/WAF.

I was genuinely hoping someone like Sucuri or Incapsula had picked it up.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by xxdesmus on Tuesday November 10, 2015 @11:24AM (#10540226)

Many many people use CloudFlare as their DNS provider.

We are among the fastest if not the fastest authoritative DNS provider in the world.

[ Parent | on HN ]

[deleted]

Re:Universal DNSSEC: Secure DNS for Every Domain by xxdesmus on Tuesday November 10, 2015 @02:21PM (#10541670)

OpenDNS provides recursive DNS, CloudFlare provides authoritative. They're complimentary, not competitive.

We don't provide split horizon DNS, that's correct. That is easily resolved for more orgs by running our own internal DNS if you need that.

http://www.datanyze.com/market-share/DNS/ claims we have 42% of the top 1M domains using our DNS. I'm not sure I actually believe that number, but a lot of people use us for their DNS.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by fweespeech on Tuesday November 10, 2015 @02:54PM (#10541949)

I deleted my post 'cause I think at this point you don't seem to get what I meant originally.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by dfox on Tuesday November 10, 2015 @10:27AM (#10539860)

Problem with DNSCrypt is that it also does not solve meaningful problem. Governments can subvert DNSCrypt in exactly same way as they can subvert DNSSEC. Additionally, DNSCrypt offers no way to verify that the returned RRs realy come from authoritative server and weren't modified (by another DNS server) in transit.

One additional feature that DNSCrypt has over DNSSEC is that it encrypts queries and responses and thus has some privacy value, on the other hand there probably is nothing privacy-sensitive in DNS queries and responses that will not get leaked by IP addresses and SNI anyway.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @11:40AM (#10540349)

No. DNSCrypt doesn't set out, on day one, to thwart NSA's ability to hijack DNS records. DNSCrypt's day-one job is to prevent coffee-shop attackers from MITMing your stub resolver, a job DNSSEC is actually incapable of doing.

DNSSEC solves no meaningful problems on day 1. DNSCrypt solves one meaningful problem on day 1. Long term, if DNSCrypt is deployed widely, it will grow to solve more of the NSA problem, as end-to-end chains of DNSCrypt-protected DNS links are deployed connecting clients to authority servers. But over the long term, DNSSEC's problems don't get any better at all.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by FullyFunctional on Tuesday November 10, 2015 @12:28PM (#10540737)

"there probably is nothing privacy-sensitive in DNS queries"

Actually, there's a lot. You can learn a tremendous amount from just looking at the NS traffic.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @10:33AM (#10539894)

I'm suggesting CloudFlare support DNSCrypt of their DNSSEC-signed responses to protect end user privacy.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by jedisct1 on Tuesday November 10, 2015 @12:44PM (#10540876)

Irrelevant. Cloudflare provides authoritative DNS services, not recursive.

We should rather encourage people to use a local, validating resolver.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by rdl on Tuesday November 10, 2015 @12:13PM (#10540619)

Certainly looking at it.

[ Parent | on HN ]