DNSSEC Would Not Help Prevent Microsoft’s Seizure Of Domains

Re:DNSSEC Would Not Help Prevent Microsoft’s Seizure Of Domains by tptacek on Wednesday July 02, 2014 @03:31PM (#7979123)

The TLSA record is going to come from wherever the DNS hierarchy says it should come from.

[ Parent | on HN ]

Re:DNSSEC Would Not Help Prevent Microsoft’s Seizure Of Domains by makomk on Wednesday July 02, 2014 @04:30PM (#7979537)

The A or AAAA record is also going to come from wherever the DNS hierarchy says it should come from. If one of the organisations upstream from you in the DNS hierarchy decides they want to police what TLS certificates sites can use by hijacking the sites' DNS and pointing it to their own servers, they can do that just as easily regardless of whether those certificates come from DNS or the traditional CAs. Once they've hijacked the domain, any major CA will happily automatically issue them a valid certificate for it.

[ Parent | on HN ]

Re:DNSSEC Would Not Help Prevent Microsoft’s Seizure Of Domains by danyork on Wednesday July 02, 2014 @03:49PM (#7979246)

So to your point you would see the attack being that the .LY registry would change the NS records for my (fictitious) .LY domain to point to a different set of name servers? i.e. removing my servers as the authoritative ones? And then being able to serve out whatever records they want to? (including a TLSA)

Is THAT the attack you see?

[ Parent | on HN ]