Despite proposed solutions, DNS security issues remain

Re:Despite proposed solutions, DNS security issues remain by dane-pgp on Wednesday October 10, 2018 @09:55AM (#18184844)

Governments directly control the DNSSEC signing keys for their ccTLDs, but at best indirectly control DNSSEC signing keys for some gTLDs. The US government could, for example, use some legal instrument to compel a US-based CA to issue a certificate for an arbitrary domain, and similarly compel a US company like Verisign (who manage the .com gTLD) to change the DNSSEC records for a .com address.

The big differences are 1) you can choose a domain under a gTLD that isn't run by an American company (or other country that is part of your threat model), 2) you can choose to run your own gTLD (at a certain cost), 3) admittedly Certificate Transparency for CAs is much further along than CT for DNSSEC, you're right.

https://tools.ietf.org/html/draft-zhang-trans-ct-dnssec-03

[ Parent | on HN ]

Re:Despite proposed solutions, DNS security issues remain by tptacek on Wednesday October 10, 2018 @10:21AM (#18185075)

I don't understand how people make this argument with a straight face. Google cannot simply abandon .COM. The most commercially important domains in the western world are all controlled by Five Eyes governments.

[ Parent | on HN ]

Re:Despite proposed solutions, DNS security issues remain by dane-pgp on Wednesday October 10, 2018 @11:03AM (#18185532)

Google already do abandon .com for localised search in individual countries, and most people aren't actually typing "google.com" to find the search engine (it's probably a browser setting).

Also, I don't understand how you can pick Google as an example with a straight face. The most commercially important websites in the western world are all run by companies that are controlled by Five Eyes governments.

[ Parent | on HN ]

Re:Despite proposed solutions, DNS security issues remain by tptacek on Wednesday October 10, 2018 @03:04PM (#18187913)

If you think "give up on .COM, .NET, .ORG, .UK, .IO, .CA, .AU, and .NZ" is a reasonable response to this problem, why stop there? Virtually everyone agrees DNSSEC isn't a great protocol; had it been designed in 2010 rather than in 1994, it would for instance take advantage of online-signing, like every modern cryptosystem does. Why not just go all the way to something like NameCoin? You've already given up on, basically, "the Internet" as people know it.

I'm not even opposed to that! (I'm not a fan of NameCoin, or any-coin at all, but whatever). I just think, be coherent about things.

[ Parent | on HN ]

Re:Despite proposed solutions, DNS security issues remain by dane-pgp on Wednesday October 10, 2018 @03:16PM (#18187989)

If your threat model includes the threat that Five Eyes governments will try to (legally, or otherwise) commandeer the DNSSEC infrastructure (and, more easily, the CA system) to actively attack users accessing your server, then it is perfectly reasonable to "give up on .COM, .NET, .ORG, .UK, .IO, .CA, .AU, and .NZ". Under such a threat model it would also be prudent to never visit a Five Eyes country, or hold any assets there.

Depending on your use case, a better approach might be to host your server in the Tor network, in which case NameCoin would indeed make some sense:

https://www.namecoin.org/2017/06/22/tor-prop279-release.html

[ Parent | on HN ]