News for hackers. Stuff that matters.

A comment on ICANN urges adopting DNSSEC now. Parent comment

Re:ICANN urges adopting DNSSEC now by wtallis on Saturday April 20, 2019 @02:50PM (#19708210)
> Literally the only attack scenario that DNSSEC protects from is when someone is MITMing your ISP, which, I believe, is something that practically never happens.

It also helps when your ISP is MITMing your attempts to get accurate DNS information. That happens all the time, though most of it is just sending you to advertisements when you're supposed to get NXDOMAIN.

[ Parent | on HN ]
Re:ICANN urges adopting DNSSEC now by xeeeeeeeeeeenu on Saturday April 20, 2019 @06:25PM (#19709280)
No, it does not protect from that. Stub resolvers (i.e. DNS clients) fully trust recursive resolvers by design and don't validate DNSSEC signatures.

In theory the client can validate them but, for various reasons, pretty much none of the implementations do that.

[ Parent | on HN ]
Re:ICANN urges adopting DNSSEC now by viraptor on Saturday April 20, 2019 @03:28PM (#19708417)
DNS over HTTPS also solves this one.
[ Parent | on HN ]