News for hackers. Stuff that matters.

A comment on Universal DNSSEC: Secure DNS for Every Domain. Parent comment

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @04:33PM (#10542680)
In a thread about user privacy and government control, I asked you for an example of a domain whose TLD might have some influence over how secure it would be post-DNSSEC. You provided the domain of a government agency.

I think we can be done now, don't you?

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by xorcist on Tuesday November 10, 2015 @05:56PM (#10543255)
This thread is about the usefulness of DNSSEC. If you have another agenda than please be explicit about it so that we can have a fruitful conversation.

You asked for a domain, any domain, and was prepared to show how Verisign could exercise their control over .com and somehow affect the validation path that DANE provides. At least that's what how I understood you. It's not always clear.

You seem to argue that susceptibility to state level actors is a counterargument to the standard, so I gave one of the few examples I know of who really need to protect against such adversaries.

Apparently my example was somehow a bad one. Take one of the big banks instead then? What could happen to swedbank.se if they signed their delegation with their TLD?

Or why don't you provide an example instead, and show in what way signing it would cede control to the NSA, or to anyone else?

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @06:21PM (#10543404)
Examples:

* Every .COM

* Every .CO.UK

* Every .COM.AU

* Every .IO

* Every .ORG

Your response:

* The Swedish tax authority's site.

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by xorcist on Wednesday November 11, 2015 @02:01AM (#10545204)
Of course Verisign controls .com. That was never in question.

Again, there are millions of use cases where .com doesn't matter.

You alluded to some control that some large entity (which I only assume to be Verisign) exercise over every important domain. I take it that was never the case?

[ Parent | on HN ]