Re:Fedora 21 To Have DNSSEC Validation Enabled By Default
by kijeda on Friday May 02, 2014 @01:40PM
(#7687028)
It would be useful to put forward a single credible scenario where "world" governments can use the DNS root private key in any fashion without detection. It is impossible to have a reasoned debate about DNSSEC with straw men like this.
[ Parent
| on HN ]
Re:Fedora 21 To Have DNSSEC Validation Enabled By Default
by tptacek on Saturday May 03, 2014 @12:09PM
(#7691258)
Are you familiar with the CAP theorem, or do you believe that it's impossible for one query to a globally distributed database to get a different answer for the same question than every other query?
Every time someone tells me that DNSSEC tampering would be "detectible", it always seems premised on the idea that everyone sees the same data. Of course, attackers will isolate their targets and attack them surgically.
What's worse, none of what you're talking about is cryptographic. This is protection by dint of being lucky enough to be on the right part of the network to be hard to attack. No sound cryptosystem works like that.