Re:Despite proposed solutions, DNS security issues remain
by tptacek on Wednesday October 10, 2018 @03:04PM
(#18187913)
If you think "give up on .COM, .NET, .ORG, .UK, .IO, .CA, .AU, and .NZ" is a reasonable response to this problem, why stop there? Virtually everyone agrees DNSSEC isn't a great protocol; had it been designed in 2010 rather than in 1994, it would for instance take advantage of online-signing, like every modern cryptosystem does. Why not just go all the way to something like NameCoin? You've already given up on, basically, "the Internet" as people know it.
I'm not even opposed to that! (I'm not a fan of NameCoin, or any-coin at all, but whatever). I just think, be coherent about things.
Re:Despite proposed solutions, DNS security issues remain
by dane-pgp on Wednesday October 10, 2018 @03:16PM
(#18187989)
If your threat model includes the threat that Five Eyes governments will try to (legally, or otherwise) commandeer the DNSSEC infrastructure (and, more easily, the CA system) to actively attack users accessing your server, then it is perfectly reasonable to "give up on .COM, .NET, .ORG, .UK, .IO, .CA, .AU, and .NZ". Under such a threat model it would also be prudent to never visit a Five Eyes country, or hold any assets there.
Depending on your use case, a better approach might be to host your server in the Tor network, in which case NameCoin would indeed make some sense:
https://www.namecoin.org/2017/06/22/tor-prop279-release.html
Also, I don't understand how you can pick Google as an example with a straight face. The most commercially important websites in the western world are all run by companies that are controlled by Five Eyes governments.