Universal DNSSEC: Secure DNS for Every Domain

Re:Universal DNSSEC: Secure DNS for Every Domain by FiloSottile on Tuesday November 10, 2015 @10:18AM (#10539792)

I don't know about you, but I'd be VERY happy about a world where the established mail protocol (wether we like it or not) is not passively eavesdroppable (STARTTLS being enough here) and where active attacks are hard, noisy and provable (enter DNSSEC+DANE).

How would exactly have Tunisia stripped STARTTLS [0] if mail servers did DNSSEC+DANE to get pinned TLS certificates?

[0] http://conferences2.sigcomm.org/imc/2015/papers/p27.pdf

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @11:30AM (#10540269)

I am not worried about attacks from Tunisia. I am worried about GCHQ.

DNSSEC deters marginal threats at the cost of encouraging serious threats. That's not a good tradeoff.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @11:57AM (#10540482)

> I am not worried about attacks from Tunisia.

Why not?

> I am worried about GCHQ.

I don't contest this part.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @11:58AM (#10540489)

At least with respect to web security, even people in Tunisia can avoid Tunisian intercept just by not using Tunisian services. But virtually no one can avoid .COM.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by sarciszewski on Tuesday November 10, 2015 @01:48PM (#10541414)

Oh. I was expecting something like, "I have secret knowledge that Tunisia's government employs less skilled attackers than the UK's."

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by yuhong on Tuesday November 10, 2015 @01:44PM (#10541384)

To be honest, HSTS worked for HTTP pretty well, and it is not like mail servers are not commonly connected to either.

[ Parent | on HN ]