News for hackers. Stuff that matters.

A comment on Calling time on DNSSEC: The costs exceed the benefits. Parent comment

Re:Calling time on DNSSEC: The costs exceed the benefits by anonymousiam on Friday June 02, 2023 @10:27PM (#36173125)
It's funny how the USG might be conflicted with both an interest in DNSSEC adoption, and an interest in preventing its adoption.

Less than a year ago I was having DNS problems reaching a subnet in the spaceforce.mil domain (via AFRC Desktop Anywhere). After some troubleshooting, I determined that the DNS server for their subnet was not configured for DNSSEC and my client was configured to refuse unauthenticated resolvers. Everything worked fine once I turned off DNSSEC locally.

DNSSEC can prevent spoofing via MITM, which is something that lots of governments do, so I can see why they might not want everyone to adopt it.

On the other hand, DNSSEC can help to secure network communication, so I can see why they might want to adopt it.

[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by nightpool on Friday June 02, 2023 @10:56PM (#36173275)
> DNSSEC can prevent spoofing via MITM, which is something that lots of governments do, so I can see why they might not want everyone to adopt it.

Only if you're NOT using HTTPS, right? In which case your traffic is already trivially spoofable, so you're not really gaining anything else by using DNSSEC there.

[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by tptacek on Friday June 02, 2023 @11:02PM (#36173293)
DNSSEC is literally a key escrow system for the North American TLDs. There's no conflict: the USG people who know what DNSSEC is want it bad.
[ Parent | on HN ]