Comcast Explains Why NASA's Web Site Was Blocked Last Week (DNSSEC)

Re:Comcast Explains Why NASA's Web Site Was Blocked Last Wee... by colmmacc on Wednesday January 25, 2012 @02:59PM (#3511441)

DNSSEC validation is part of chrome;

http://www.imperialviolet.org/2011/06/16/dnssecchrome.html

DNSSEC is about end-to-end authenticity for DNS data, and one of those ends is the user application, so it's understandable that a burden of responsibility would shift towards it. TSIG is about transport security, it's not about data authenticity, I wouldn't describe it as an alternative - it is complementary to DNSSEC.

If DNSSEC succeeds, then doubtless there will be some successful in-application libraries and APIs for performing this - and those state machines won't be something we all have to worry about. But yes, it does shift the work-load.

[ Parent | on HN ]

Re:Comcast Explains Why NASA's Web Site Was Blocked Last Wee... by tptacek on Wednesday January 25, 2012 @03:08PM (#3511481)

No, a single feature that exploits DNSSEC validation is part of Chrome.

Securing DNS with "end-to-end authenticity for DNS data" is like securing the web by signing every individual web page.

[ Parent | on HN ]

Re:Comcast Explains Why NASA's Web Site Was Blocked Last Wee... by danyork on Wednesday January 25, 2012 @03:40PM (#3511630)

Plugins/extensions are available now for both Chrome and Firefox that provide a visual indicator in the address bar:

http://www.internetsociety.org/deploy360/resources/how-to-ad...

But, to your point, these are not built-in and require a user to actually install the extensions. And of course, a user can ignore the key icon (as some ignore the lock-in and SSL/TLS popups).

[ Parent | on HN ]