News for hackers. Stuff that matters.

A comment on Fedora 21 To Have DNSSEC Validation Enabled By Default. Parent comment

Re:Fedora 21 To Have DNSSEC Validation Enabled By Default by dfc on Friday May 02, 2014 @01:17PM (#7686930)
Why did you pick an example that does not use DNSSEC? It seems your thesis would be a lot stronger if you used a top and second level domain that actually implemented DNSSEC:

  root@fw:~# unbound-host  -t A -v bit.ly
  bit.ly has address 69.58.188.39 (insecure)
  bit.ly has address 69.58.188.40 (insecure)
More: http://dnssec-debugger.verisignlabs.com/bit.ly and http://dnsviz.net/d/bit.ly/dnssec/
[ Parent | on HN ]
Re:Fedora 21 To Have DNSSEC Validation Enabled By Default by wglb on Friday May 02, 2014 @01:49PM (#7687078)
I can't tell if you are trying to deliberately miss the point.

If those in charge of ly decided to implement dnssec, then who is in charge with respect to GP.

[ Parent | on HN ]
Re:Fedora 21 To Have DNSSEC Validation Enabled By Default by IvyMike on Friday May 02, 2014 @01:26PM (#7686965)
> Why did you pick an example that does not use DNSSEC?

Because I'm trying to illustrate how much additional security you might or might not get if you added DNSSEC, especially with regards to government entities.

[ Parent | on HN ]
Re:Fedora 21 To Have DNSSEC Validation Enabled By Default by dfc on Friday May 02, 2014 @01:34PM (#7687004)
The answer is "N/A." The .ly tld is not signed so DNSSEC could never attest to the authenticity of the A record for bit.ly.

In order for this to be a useful exercise you should structure the question in such a way that there is as much potential for government interference as possible. (Unless you are looking for a specific answer and you are trying to lead the respondent.) Government interference with DNSSEC is not limited to the `.` zone. Or put another way, DNSSEC's attack surface area is not limited to the sacred KSK.

[ Parent | on HN ]
Re:Fedora 21 To Have DNSSEC Validation Enabled By Default by arjie on Friday May 02, 2014 @02:18PM (#7687233)
If bit.ly implemented DNSSEC exactly to spec, and it appears clean to a user, who could be an attacker and in what way?
[ Parent | on HN ]
Re:Fedora 21 To Have DNSSEC Validation Enabled By Default by dfc on Friday May 02, 2014 @03:01PM (#7687477)
Anyone can be an attacker that can exert influence (legal/kinetic/digital) over:

  Here:        .
  Here:     .ly.
  Here: .bit.ly.
The attack surface of freebsd.org is similiar except there is a different set of actors that can exert legal influence over .org.

  Here:             .  # G/K/D same as bit.ly
  Here:         .org.  #   K/D same as bit.ly
  Here: .freebsd.org.  #   K/D same as bit.ly
[ Parent | on HN ]