DNSSEC explained: Why you might want to implement it on your domain

https://www.csoonline.com/article/3569277/dnssec-explained-why-you-might-want-to-implement-it-on-your-domain.html#tk.rss_all

by c0r0n3r • 6 years ago

19 14 6 years ago

csoonline.com

brightball• 6 years ago

Would be a worthwhile article to read if it wasn't pay walled.

SimeVidas• 6 years ago

I’m a simple man. Website shows fullscreen popup that interrupts me and also scrolls the page to the top. I close the tab.

anatolinicolae• 6 years ago

same.

sdiq• 6 years ago

Repeating same is probably pointless by now but same, too.

MayeulC2• 6 years ago

The article is behind a paywall, but more to the point: why wouldn't I want this?

It's opt-in at every registrar I've used, although it seems like a no-brainer to me? What am I missing?

As an aside, I like DoH, but dislike the fact that my web browsers then don't use /etc/hosts. Is there a way to provide it at the system level?

jessaustin• 6 years ago

HN's resident DNSSEC critic, 'tptacek, has written extensively on this topic:

https://sockpuppet.org/blog/2015/01/15/against-dnssec/

https://sockpuppet.org/stuff/dnssec-qa.html

https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con...

Ajedi32• 6 years ago

I find most of these arguments to be pretty weak TBH. From the first article:

All secure crypto on the Internet assumes that the DNS lookup from names to IP addresses are insecure.

This isn't strictly true. It's true that TLS makes DNS spoofing ineffective against end-users, but CAs still have to rely on domain validation to decide who to issue TLS certs to in the first place, and domain validation, in turn, relies on DNS lookups being secure.

And governments control the DNS.

This is true, but that's an argument for not securing DNS, it's an argument for replacing DNS entirely. Governments control DNS regardless of whether or not DNSSEC is deployed.

DNSSEC is Cryptographically Weak

No it isn't. Current implementations of DNSSEC are cryptographically weak, but DNSSEC itself is not. The solution to this is to deploy new, stronger keys (like Cloudflare is doing[1]), not to get rid of DNSSEC entirely.

DNSSEC is Expensive To Adopt [..] DNSSEC is Expensive To Deploy

This is true of all security measure to some extent. TLS was expensive to adopt and deploy prior to the advent of free, automated CAs like Let's Encrypt. The solution to these problems is to build tools and systems which make DNSSEC easier to adopt and deploy, not to abandon it entirely.

The rest of the arguments on that page are reasonable criticisms of specific elements of DNSSEC's design (some of which could be improved by changes to DNSSEC's design or implementation), but I don't really see them as show-stoppers. If there were a better alternative to DNSSEC available I would find these arguments much more persuasive, but since the only alternative seems to be not securing DNS records at all any small design flaws seem pretty minor in comparison.

[1] https://www.cloudflare.com/dns/dnssec/ecdsa-and-dnssec/

xythian• 6 years ago

I'd love to know why some of the major companies of the internet aren't using DNSSEC.

Google, Amazon, Facebook, Twitter, Microsoft, Netflix, etc. don't have DNSSEC enabled for their domains.

Is it as simple as they're just concerned about the occasional DNS request failing to do DNSSEC issues and thus reducing precious traffic?

tptacek2• 6 years ago

The reliability hit is almost certainly the major reason, followed by the administrative hassle (you might be as surprised as I was, after joining Fly and writing about our certificate infrastructure, what a giant hassle TLS certificate management is to bigger companies --- and that's just TLS, which is simpler to manage than DNSSEC).

But against that you have to pit the marginal --- practically nonexistent --- security benefit you'd get from all the work you'd put in.

Everyone has more important things to do.

andreareina• 6 years ago

Native system-wide DoH seems to be coming to windows 10[1]. For *nix there's unbound[2] which does DoT[LS] and cloudflared[3].

[1] https://techcommunity.microsoft.com/t5/networking-blog/windo...

[2] https://nlnetlabs.nl/projects/unbound/about/

[3] https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo...

Whatarethese• 6 years ago

Can anyone put this on pastebin or something? Paywalled.

DNSSEC explained: Why you might want to implement it on your domain

Related Stories