Re:Why CISA Issued Our First Emergency Directive
by Operyl on Saturday February 16, 2019 @04:38PM
(#19181097)
It failed on this case, so it must equally fail in every? I don’t buy that ..
[ Parent
| on HN ]
Re:Why CISA Issued Our First Emergency Directive
by eropple on Saturday February 16, 2019 @04:59PM
(#19181197)
No. The assertion is that it does fail to provide a benefit in practical, real-world cases, but defends against a fairly niche attack.
There's a reason that 'tptacek called it "security theater". Its implementors could better spend that time on actual security measures for things that are much more likely to happen...like defense in depth for credential leaking.
Re:Why CISA Issued Our First Emergency Directive
by rocqua on Sunday February 17, 2019 @05:54AM
(#19183807)
It protects against targeted DNS poisoning, but that is already covered by TLS.
Re:Why CISA Issued Our First Emergency Directive
by ancarda on Sunday February 17, 2019 @07:49AM
(#19184208)
How is that protected by TLS? Wouldn't you need a good A/AAAA record to make a connection to a TLS server?
Or do you perhaps mean DNS over (TLS|HTTPS)? I never saw that as a complete replacement for DNSSEC; it provides transport security, yes, but how do we know we aren't talking to a malicious resolver? Maybe that's not as much of a threat if people aren't using DNS servers from their ISP -- which sometimes inject ads or otherwise tamper with traffic.