News for hackers. Stuff that matters.

A comment on 72% of smart TVs and 46% of game consoles hardcode DNS settings. Parent comment

Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by manigandham on Sunday December 06, 2020 @02:14PM (#25325825)
Sure, DNSSEC provides authentication and integrity rather than encrypted traffic, which makes spoofing or rewriting the responses hard.

Why do you say it's not authenticated? If they're using the newer standards then that's what it provides. If they're not then there's no issue with network filtering as usual.

[ Parent | on HN ]
Re:72% of smart TVs and 46% of game consoles hardcode DNS se... by tptacek on Sunday December 06, 2020 @03:20PM (#25326311)
Again: the article discusses an environment where machines on a home network are refusing to use the DNS servers the network is configured to use. DNSSEC authenticates requests between servers. But between DNS clients ("stub resolvers") and servers ("full recursers"), there is no authentication, just a single bit in the header that says "trust me, I authenticated this data".

It doesn't matter if you're using your ISP's servers, 8.8.8.8, 1.1.1.1, or a custom server you set up on Digital Ocean somewhere: an on-path attacker can forge DNSSEC responses to you. It's a ridiculous situation.

[ Parent | on HN ]