News for hackers. Stuff that matters.

A comment on Hijack of Amazon’s domain service used to reroute web traffic for two hours. Parent comment

Re:Hijack of Amazon’s domain service used to reroute web tra... by raldi on Wednesday April 25, 2018 @09:10AM (#16921182)
There's also https://tools.ietf.org/html/rfc4956 , which allows a domain to sign that a range of DNS entries does not exist; under this system, a client resolver could demand cryptographic proof that a domain was missing certain records, which stops the MitM RR-stripping attack.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by tptacek on Wednesday April 25, 2018 @11:04AM (#16922131)
You're describing authenticated denial, which has been a characteristic of DNSSEC since 1994.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by raldi on Wednesday April 25, 2018 @11:26AM (#16922370)
Yes, exactly. The RFC I linked to specifically refers to Authenticated Denial in the Security Considerations section.
[ Parent | on HN ]