Re:Deep packet inspection could be outlawed in US
by tptacek on Friday April 24, 2009 @02:20PM
(#577915)
(1) No part of the DNS is currently any hacker's wet dream. Why bother spoofing at all? You don't need to bust out the batmobile to get into most people's accounts.
(2) The technique that "extended" DNS' security is the same technique that protects plenty of other core Internet protocols, so if it doesn't work at least in the medium term, we're all doomed.
(3) The issue isn't whether DNS is breakable --- it always has been --- it' s how easy it is. The problem is about cost, not about raw capability. If you can't pull the attack off drive-by, it doesn't make a difference in 2009.
(4) Anybody who tries to sell you on a DPI solution to DNS security is scamming you. You'd need a globally deployed network of DPI boxes, all synchronized, to make a dent in the problem.
(2) The technique that "extended" DNS' security is the same technique that protects plenty of other core Internet protocols, so if it doesn't work at least in the medium term, we're all doomed.
(3) The issue isn't whether DNS is breakable --- it always has been --- it' s how easy it is. The problem is about cost, not about raw capability. If you can't pull the attack off drive-by, it doesn't make a difference in 2009.
(4) Anybody who tries to sell you on a DPI solution to DNS security is scamming you. You'd need a globally deployed network of DPI boxes, all synchronized, to make a dent in the problem.