Calling time on DNSSEC: The costs exceed the benefits

Re:Calling time on DNSSEC: The costs exceed the benefits by wlonkly on Sunday June 04, 2023 @04:51PM (#36189476)

I think the attack tptacek is suggesting is where a government replaces your key with their key, and your nameservers with their nameservers (perhaps with a passthrough for non-interesting records), at which point they can send whichever responses they want with a valid signature.

In your example the Czech government would be the bad actor, but the US government could be the bad actor for .com.

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by cyberax on Sunday June 04, 2023 @06:43PM (#36190255)

The thing is, I can pick and choose the government to host the website. If I don't like the Czech government's policies, I can use a domain in Turkey or Libya.

The hierarchical nature of DNS makes it impossible for the US to covertly mess with that.

This is strictly better than the current situation where de-facto any government can get a certificate for your domain name by putting pressure on one of the countless CAs. And quite a few governments even have their own CAs recognized by browsers.

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by tptacek on Monday June 05, 2023 @06:41PM (#36205151)

This is how you know the argument has lost the plot: your response to government manipulation of Internet cryptography is that Google can just leave .COM.

[ Parent | on HN ]