Re:Universal DNSSEC: Secure DNS for Every Domain
by azernik on Tuesday November 10, 2015 @05:23PM
(#10543060)
On most desktop Linuces I've dealt with, the "stub resolver" is dnsmasq, which is quite full-featured and DNSSEC-capable... except that distributions don't enable the feature or distribute a trust anchor. But there aren't any deep structural problems preventing them from flipping the switch [1] - not like, say, the deep coupling between layer 3 and layer 4 that killed SCTP and other TCP/UDP alternatives in practice.
[1] For example, this configuration change is all that's required to enable DNSSEC on Gentoo, and would probably also work on Ubuntu and Fedora: https://wiki.gentoo.org/wiki/Dnsmasq#DNSSEC
Re:Universal DNSSEC: Secure DNS for Every Domain
by tptacek on Tuesday November 10, 2015 @05:29PM
(#10543097)
I'm happy to concede that the desktop Linux people don't have this issue. We should look into DNSSEC once Linux wins the desktop.
Re:Universal DNSSEC: Secure DNS for Every Domain
by azernik on Tuesday November 10, 2015 @05:54PM
(#10543242)
Linux is a test case. If you can get Linux to use DNSSEC without cooperation from intermediate routers and caches, then it's just single-organization engineering work - Apple and Microsoft would need to write DNSSEC-capable client implementations (which Microsoft already has for Windows Server) and deploy them. This is an OS feature like any other OS feature.
The obstacles to changing to IPv6, or to making any changes whatsoever to TCP, just aren't there.
Re:Universal DNSSEC: Secure DNS for Every Domain
by tptacek on Tuesday November 10, 2015 @06:05PM
(#10543310)
And so it took 21 years to get to this point with DNSSEC because...
Re:Universal DNSSEC: Secure DNS for Every Domain
by azernik on Tuesday November 10, 2015 @06:15PM
(#10543374)
Because it takes non-zero work, and doesn't add much value on top of SSL/TLS, which got wide deployment first.
As far as I understand, IPSec + DNSSEC gets similar security guarantees to SSL/TLS without identity certification, so once you have one there isn't any real economic incentive to put massive effort into developing the other.
There is a difference between the way TCP/IP works when sites like HowStuffWorks describe it, and the way it works in the real world.
In the real world, when you type a site name into your browser bar, your browser invokes a stub resolver to send a DNS query to a DNS recursive cache server, which is virtually never running on your local machine.
So, however it's supposed to work in theory, in practice there is DNS traffic running between your machine and some server somewhere on the Internet (perhaps very far away on the Internet if you use OpenDNS or Google DNS), and DNSSEC does not protect those queries. They're flying around the network in plaintext protected only by a 16 bit plaintext query ID and somewhat less than 16 bits of entropy in source ports, if you're lucky.
I'm pretty sure I can speak reliably for what that article I linked to claims.