News for hackers. Stuff that matters.

A comment on Universal DNSSEC: Secure DNS for Every Domain. Parent comment

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @09:49AM (#10539590)
SMTP email is simply. not. secure. If you need your messages to be protected from world governments, don't rely on SMTP for your security.

There's an argument that DNSSEC might make a marginal dent in protecting email from for-profit criminal enterprises. I don't believe it will, but let's stipulate that it does. It accomplishes that by setting up a new PKI whose roots are de jure controlled by the Five Eyes governments. How can that possibly be worth the gain?

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by FiloSottile on Tuesday November 10, 2015 @10:18AM (#10539792)
I don't know about you, but I'd be VERY happy about a world where the established mail protocol (wether we like it or not) is not passively eavesdroppable (STARTTLS being enough here) and where active attacks are hard, noisy and provable (enter DNSSEC+DANE).

How would exactly have Tunisia stripped STARTTLS [0] if mail servers did DNSSEC+DANE to get pinned TLS certificates?

[0] http://conferences2.sigcomm.org/imc/2015/papers/p27.pdf

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @11:30AM (#10540269)
I am not worried about attacks from Tunisia. I am worried about GCHQ.

DNSSEC deters marginal threats at the cost of encouraging serious threats. That's not a good tradeoff.

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @11:57AM (#10540482)
> I am not worried about attacks from Tunisia.

Why not?

> I am worried about GCHQ.

I don't contest this part.

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @11:58AM (#10540489)
At least with respect to web security, even people in Tunisia can avoid Tunisian intercept just by not using Tunisian services. But virtually no one can avoid .COM.
[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @01:48PM (#10541414)
Oh. I was expecting something like, "I have secret knowledge that Tunisia's government employs less skilled attackers than the UK's."
[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by yuhong on Tuesday November 10, 2015 @01:44PM (#10541384)
To be honest, HSTS worked for HTTP pretty well, and it is not like mail servers are not commonly connected to either.
[ Parent | on HN ]