Calling time on DNSSEC: The costs exceed the benefits

Re:Calling time on DNSSEC: The costs exceed the benefits by cyberax on Saturday June 03, 2023 @06:45PM (#36181232)

You don't understand how DNS works. The root is controlled by a US organization (not the government, but whatever) and it delegates individual TLDs to other organizations in other jurisdictions.

So if the US government wants to fake (for example) mail.google.cz it needs to:

1. Create a fake .cz record and sign it with the root KSK. 2. Make sure only you see this record (so they must control the network path to you). 3. Create a fake response.

This is technically possible, but highly unlikely. It's also going to be very visible and easily detectable.

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by tptacek on Saturday June 03, 2023 @06:58PM (#36181325)

I'm pretty sure I do understand how the DNS works.

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by wlonkly on Sunday June 04, 2023 @04:51PM (#36189476)

I think the attack tptacek is suggesting is where a government replaces your key with their key, and your nameservers with their nameservers (perhaps with a passthrough for non-interesting records), at which point they can send whichever responses they want with a valid signature.

In your example the Czech government would be the bad actor, but the US government could be the bad actor for .com.

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by cyberax on Sunday June 04, 2023 @06:43PM (#36190255)

The thing is, I can pick and choose the government to host the website. If I don't like the Czech government's policies, I can use a domain in Turkey or Libya.

The hierarchical nature of DNS makes it impossible for the US to covertly mess with that.

This is strictly better than the current situation where de-facto any government can get a certificate for your domain name by putting pressure on one of the countless CAs. And quite a few governments even have their own CAs recognized by browsers.

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by tptacek on Monday June 05, 2023 @06:41PM (#36205151)

This is how you know the argument has lost the plot: your response to government manipulation of Internet cryptography is that Google can just leave .COM.

[ Parent | on HN ]